fb_udf_test.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	fb_udf_test.dll
size	176619 (0x2b1eb)
md5	ea8ce7a95d3356bb56f9e5e81ddf06fa

type	PE32+ executable (DLL) (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0x12
TimeDateStamp	0x5c64157c
PointerToSymbolTable	0x17800
NumberOfSymbols	0x8b4
SizeOfOptionalHeader	0xf0
Characteristics	0x2026
Magic	0x20b
LinkerVersion	2.30
SizeOfCode	0x1e00
SizeOfInitializedData	0x6000
SizeOfUninitializedData	0xa00
AddressOfEntryPoint	0x1330
BaseOfCode	0x1000
ImageBase	0x6b280000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x25000
SizeOfHeaders	0x600
CheckSum	0x3a89d
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1c68	0x1e00	R-X CODE IDATA
.data	0x3000	0x80	0x200	RW- IDATA
.rdata	0x4000	0x2b20	0x2c00	R-- IDATA
.pdata	0x7000	0x24c	0x400	R-- IDATA
.xdata	0x8000	0x1c4	0x200	R-- IDATA
.bss	0x9000	0x920	0	RW- UDATA
.edata	0xa000	0x78	0x200	R-- IDATA
.idata	0xb000	0x5d0	0x600	RW- IDATA
.CRT	0xc000	0x58	0x200	RW- IDATA
.tls	0xd000	0x10	0x200	RW- IDATA
.reloc	0xe000	0x64	0x200	R-- IDATA DISCARDABLE
/4	0xf000	0x90	0x200	R-- IDATA DISCARDABLE
/19	0x10000	0xfd0d	0xfe00	R-- IDATA DISCARDABLE
/31	0x20000	0x39f	0x400	R-- IDATA DISCARDABLE
/45	0x21000	0x665	0x800	R-- IDATA DISCARDABLE
/57	0x22000	0x118	0x200	R-- IDATA DISCARDABLE
/70	0x23000	0xa5	0x200	R-- IDATA DISCARDABLE
/81	0x24000	0x30	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0xa000	0x78
IMPORT	0xb000	0x5d0
RESOURCE	0	0
EXCEPTION	0x7000	0x24c
SECURITY	0	0
BASERELOC	0xe000	0x64
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x68a0	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xb174	0x138
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x6b28d000	0x6b28d008	0x6b2895cc	0x6b28c030	0	0

module_name	hint	function_name
KERNEL32.dll	269	DeleteCriticalSection
KERNEL32.dll	305	EnterCriticalSection
KERNEL32.dll	536	GetCurrentProcess
KERNEL32.dll	537	GetCurrentProcessId
KERNEL32.dll	541	GetCurrentThreadId
KERNEL32.dll	610	GetLastError
KERNEL32.dll	747	GetSystemTimeAsFileTime
KERNEL32.dll	775	GetTickCount
KERNEL32.dll	864	InitializeCriticalSection
KERNEL32.dll	952	LeaveCriticalSection
KERNEL32.dll	1094	QueryPerformanceCounter
KERNEL32.dll	1180	RtlAddFunctionTable
KERNEL32.dll	1181	RtlCaptureContext
KERNEL32.dll	1188	RtlLookupFunctionEntry
KERNEL32.dll	1195	RtlVirtualUnwind
KERNEL32.dll	1347	SetUnhandledExceptionFilter
KERNEL32.dll	1361	Sleep
KERNEL32.dll	1376	TerminateProcess
KERNEL32.dll	1396	TlsGetValue
KERNEL32.dll	1410	UnhandledExceptionFilter
KERNEL32.dll	1444	VirtualProtect
KERNEL32.dll	1446	VirtualQuery
msvcrt.dll	84	__iob_func
msvcrt.dll	123	_amsg_exit
msvcrt.dll	331	_initterm
msvcrt.dll	440	_lock
msvcrt.dll	813	_unlock
msvcrt.dll	1031	abort
msvcrt.dll	1050	calloc
msvcrt.dll	1089	free
msvcrt.dll	1101	fwrite
msvcrt.dll	1156	memcpy
msvcrt.dll	1176	realloc
msvcrt.dll	1186	signal
msvcrt.dll	1207	strlen
msvcrt.dll	1210	strncmp
msvcrt.dll	1242	vfprintf

ord	entry_va	function_name
1	0x13cf	testof_dsc_sub_type
2	0x1492	testof_dsc_sub_type_var

module_name	fb_udf_test.dll
flags	0
timestamp	2019-02-13 13:02:52
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0xa030
Functions(2)	0xa028
NameOrdinals(2)	0xa038

show previews

offset	size	type	comment
0	176619	DLL	02/13/2019 13:02:52	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x95cc