filenameintl.dll
size152489 (0x253a9)
md5eb2d4c4d4a527bc88a69a16cc99afcf5
typePE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xb
TimeDateStamp0x4c8c7195
PointerToSymbolTable0x1ac00
NumberOfSymbols0x75b
SizeOfOptionalHeader0xe0
Characteristics0x2306
Magic0x10b
LinkerVersion2.20
SizeOfCode0x11800
SizeOfInitializedData0x1a800
SizeOfUninitializedData0xe00
AddressOfEntryPoint0x10c0
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x6a300000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x23000
SizeOfHeaders0x400
CheckSum0x2d358
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x116b00x11800R-X CODE IDATA
.data0x130000x3800x400RW- IDATA
.rdata0x140000x54e00x5600R-- IDATA
.eh_fram0x1a0000xdc0x200RW- IDATA
.bss0x1b0000xda80RW- UDATA
.edata0x1c0000x3510x400R-- IDATA
.idata0x1d0000x9c40xa00RW- IDATA
.CRT0x1e0000x180x200RW- IDATA
.tls0x1f0000x200x200RW- IDATA
.rsrc0x200000x6c40x800RW- IDATA
.reloc0x210000x18540x1a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1c0000x351
IMPORT0x1d0000x9c4
RESOURCE0x200000x6c4
EXCEPTION00
SECURITY00
BASERELOC0x210000x1854
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x1f0000x18
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x6a31f0190x6a31f01c0x6a31b3200x6a31e00400
typenamesizecp
VERSION#116440
module_namehintordfunction_name
ADVAPI32.DLL386RegCloseKey
ADVAPI32.DLL413RegOpenKeyExA
ADVAPI32.DLL423RegQueryValueExA
KERNEL32.dll82CloseHandle
KERNEL32.dll129CreateEventA
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll249EnumResourceLanguagesA
KERNEL32.dll352FreeLibrary
KERNEL32.dll358GetACP
KERNEL32.dll369GetCPInfoExA
KERNEL32.dll451GetCurrentThreadId
KERNEL32.dll510GetLastError
KERNEL32.dll512GetLocaleInfoA
KERNEL32.dll527GetModuleFileNameA
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll577GetProcAddress
KERNEL32.dll619GetSystemDirectoryA
KERNEL32.dll648GetThreadLocale
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll743InterlockedDecrement
KERNEL32.dll744InterlockedExchange
KERNEL32.dll747InterlockedIncrement
KERNEL32.dll763IsDBCSLeadByteEx
KERNEL32.dll774IsValidCodePage
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll817LoadLibraryA
KERNEL32.dll860MultiByteToWideChar
KERNEL32.dll1065SetEvent
KERNEL32.dll1152Sleep
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1223WaitForSingleObject
KERNEL32.dll1247WideCharToMultiByte
msvcrt.dll6_close
msvcrt.dll32_fstat
msvcrt.dll37_getcwd
msvcrt.dll58_open
msvcrt.dll64_read
msvcrt.dll80_strdup
msvcrt.dll52__dllonexit
msvcrt.dll61__lc_codepage
msvcrt.dll65__mb_cur_max
msvcrt.dll182_errno
msvcrt.dll266_iob
msvcrt.dll268_isctype
msvcrt.dll392_pctype
msvcrt.dll451_stricmp
msvcrt.dll455_strnicmp
msvcrt.dll490_vsnprintf
msvcrt.dll491_vsnwprintf
msvcrt.dll538_winmajor
msvcrt.dll583abort
msvcrt.dll592atoi
msvcrt.dll594bsearch
msvcrt.dll595calloc
msvcrt.dll607fclose
msvcrt.dll610fflush
msvcrt.dll613fgets
msvcrt.dll618fopen
msvcrt.dll620fputc
msvcrt.dll622fputwc
msvcrt.dll625free
msvcrt.dll633fwrite
msvcrt.dll637getenv
msvcrt.dll671localeconv
msvcrt.dll676malloc
msvcrt.dll682memcpy
msvcrt.dll683memmove
msvcrt.dll690putc
msvcrt.dll695qsort
msvcrt.dll698realloc
msvcrt.dll704setlocale
msvcrt.dll709sprintf
msvcrt.dll714strchr
msvcrt.dll715strcmp
msvcrt.dll717strcpy
msvcrt.dll718strcspn
msvcrt.dll721strlen
msvcrt.dll723strncmp
msvcrt.dll724strncpy
msvcrt.dll728strstr
msvcrt.dll732strtoul
msvcrt.dll742tolower
msvcrt.dll748vfprintf
msvcrt.dll749vfwprintf
msvcrt.dll751vsprintf
msvcrt.dll755wcschr
msvcrt.dll761wcslen
ordentry_vafunction_name
10x3168_nl_expand_alias
20x1bd60_nl_msg_cat_cntr
30xb3b4bind_textdomain_codeset
40xb3a8bindtextdomain
50xb36cdcgettext
60xb390dcngettext
70xb360dgettext
80xb384dngettext
90xb354gettext
100x1628libintl_bind_textdomain_codeset
110x1610libintl_bindtextdomain
120x1640libintl_dcgettext
130x4d14libintl_dcngettext
140x167clibintl_dgettext
150x4d4clibintl_dngettext
160x92a8libintl_fprintf
170x16a0libintl_gettext
180x4d7clibintl_ngettext
190x92f4libintl_printf
200x6004libintl_set_relocation_prefix
210xb1eclibintl_setlocale
220x9474libintl_snprintf
230x93a4libintl_sprintf
240x3274libintl_textdomain
250x91f8libintl_vfprintf
260x92cclibintl_vprintf
270x93c8libintl_vsnprintf
280x9310libintl_vsprintf
290xb378ngettext
300xb39ctextdomain
module_nameintl.dll
flags0
timestamp2010-09-12 06:22:13
version0.0
ordinal_base1
nFunctions30
nNames30
Names(30)0x1c0a0
Functions(30)0x1c028
NameOrdinals(30)0x1c118

StringTable 04090000

CommentsThis library is free software; you can redistribute it and/or modify it under the terms of the GNU Library General Public License. You should have received a copy of the GNU Library General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
CompanyNameFree Software Foundation
FileDescriptionLGPLed libintl for Windows NT/2000/XP/Vista/7 and Windows 95/98/ME
FileVersion0.18.1
InternalNameintl.dll
LegalCopyrightCopyright (C) 1995-2010
LegalTrademarks
OriginalFilenameintl.dll
ProductNamelibintl: accessing NLS message catalogs
ProductVersion0.18.1

VS_FIXEDFILEINFO

FileVersion0.18.1.0
ProductVersion0.18.1.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x10004
FileType2
FileSubtype0
offsetsizetypecomment
0109568DLL09/12/2010 06:22:13#
15c115HTM#
1ac0042921BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x1b320