odbc.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	odbc.dll
size	16384 (0x4000)
md5	e788b550d2808cb6e9af1971adf57b07

type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
158	30319	1
171	30319	2
147	30729	6
156	30319	5
1	0	73
170	30319	12
155	30319	1
157	30319	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	5
TimeDateStamp	0x5d41c2f9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	10.0
SizeOfCode	0x2a00
SizeOfInitializedData	0x2000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3304
BaseOfCode	0x1000
ImageBase	0x180000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x8000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2862	0x2a00	R-X CODE
.rdata	0x4000	0xb2f	0xc00	R-- IDATA
.data	0x5000	0xf78	0x200	RW- IDATA
.pdata	0x6000	0x1e0	0x200	R-- IDATA
.reloc	0x7000	0x24	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x4a90	0x9f
IMPORT	0x448c	0x78
RESOURCE	0	0
EXCEPTION	0x6000	0x1e0
SECURITY	0	0
BASERELOC	0x7000	0x10
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x4000	0x270
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
q.exe	15		jv
q.exe	59		ymd
q.exe	30		kpn
q.exe	12		ja
q.exe	42		r0
q.exe	50		sn
q.exe	29		kp
q.exe	13		jk
q.exe	57		xD
q.exe	58		xT
q.exe	36		ktn
q.exe	52		ss
q.exe	14		js
q.exe	27		knk
q.exe	31		krr
q.exe	26		kj
ODBC32.dll		40
ODBC32.dll		76
ODBC32.dll		43
ODBC32.dll		11
ODBC32.dll		18
ODBC32.dll		8
ODBC32.dll		61
ODBC32.dll		60
ODBC32.dll		54
ODBC32.dll		4
ODBC32.dll		13
ODBC32.dll		3
ODBC32.dll		65
ODBC32.dll		9
ODBC32.dll		14
ODBC32.dll		10
ODBC32.dll		2
ODBC32.dll		1
ODBC32.dll		39
ODBC32.dll		41
ODBC32.dll		7
ODBC32.dll		16
USER32.dll	303		GetForegroundWindow
MSVCR100.dll	328		__dllonexit
MSVCR100.dll	320		__clean_type_info_names_internal
MSVCR100.dll	326		__crt_debugger_hook
MSVCR100.dll	287		__CppXcptFilter
MSVCR100.dll	286		__C_specific_handler
MSVCR100.dll	414		_amsg_exit
MSVCR100.dll	498		_encoded_null
MSVCR100.dll	647		_initterm_e
MSVCR100.dll	646		_initterm
MSVCR100.dll	775		_malloc_crt
MSVCR100.dll	758		_lock
MSVCR100.dll	1438		malloc
MSVCR100.dll	1453		memset
MSVCR100.dll	1379		free
MSVCR100.dll	1459		printf
MSVCR100.dll	925		_onexit
MSVCR100.dll	1115		_unlock
KERNEL32.dll	640		GetSystemTimeAsFileTime
KERNEL32.dll	455		GetCurrentProcessId
KERNEL32.dll	459		GetCurrentThreadId
KERNEL32.dll	666		GetTickCount
KERNEL32.dll	937		QueryPerformanceCounter
KERNEL32.dll	226		DisableThreadLibraryCalls
KERNEL32.dll	1048		RtlCaptureContext
KERNEL32.dll	1055		RtlLookupFunctionEntry
KERNEL32.dll	1062		RtlVirtualUnwind
KERNEL32.dll	770		IsDebuggerPresent
KERNEL32.dll	1203		SetUnhandledExceptionFilter
KERNEL32.dll	1250		UnhandledExceptionFilter
KERNEL32.dll	454		GetCurrentProcess
KERNEL32.dll	1230		TerminateProcess
KERNEL32.dll	1216		Sleep
KERNEL32.dll	203		DecodePointer
KERNEL32.dll	238		EncodePointer

ord	entry_va	function_name
1	0x13d0	close
2	0x1940	eval
3	0x1700	fkeys
4	0x1410	keys
5	0x1000	open
6	0x1640	tables
7	0x1850	views

module_name	odbc.dll
flags	0
timestamp	2019-07-31 16:34:01
version	0.0
ordinal_base	1
nFunctions	7
nNames	7
Names(7)	0x4ad4
Functions(7)	0x4ab8
NameOrdinals(7)	0x4af0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	10800	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK