filenamebackend.dll
size5241344 (0x4ffa00)
md5ede88295b9d8e052f55271faad983c9a
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x78
blocks_in_file1
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0
ss0
sp0
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x78

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 24 00 00                           |mode.$..        |

PE Header

SignaturePE
Machine0x14c
NumberOfSections9
TimeDateStamp0x7f6e12c3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2122
Magic0x10b
LinkerVersion14.0
SizeOfCode0x3f0c00
SizeOfInitializedData0x10e600
SizeOfUninitializedData0
AddressOfEntryPoint0x34fb20
BaseOfCode0x1000
BaseOfData0
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x519000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x4140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x3f0b7f0x3f0c00R-X CODE
.rdata0x3f20000x92bfc0x92c00R-- IDATA
.data0x4850000x1914c0x6600RW- IDATA
.00cfg0x49f00040x200R-- IDATA
.rodata0x4a00000x800x200R-X CODE
.tls0x4a10000xa50x200RW- IDATA
.voltbl0x4a20000x15c0x200---
.rsrc0x4a30000x581080x58200R-- IDATA
.reloc0x4fc0000x1ccac0x1ce00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x47fdd70x177
IMPORT0x47ff4e0x12c
RESOURCE0x4a30000x58108
EXCEPTION00
SECURITY00
BASERELOC0x4fc0000x1ccac
DEBUG0x47c3ac0x38
ARCHITECTURE00
GLOBALPTR00
TLS0x47c2b00x18
LOAD_CONFIG0x3f27600xbc
Bound_IAT00
IAT0x4804f80x47c
Delay_IAT0x47fd640x40
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x104a10000x104a10a40x1048b6900x1047fd3400x400000
typenamesizecp
CURSOR#1169400
CURSOR#296440
CURSOR#342680
CURSOR#4169400
CURSOR#596440
CURSOR#642680
CURSOR#7169400
CURSOR#896440
CURSOR#942680
CURSOR#10169400
CURSOR#1196440
CURSOR#1242680
CURSOR#13169400
CURSOR#1496440
CURSOR#1542680
CURSOR#16169400
CURSOR#1796440
CURSOR#1842680
CURSOR#1942680
CURSOR#2042680
CURSOR#2142680
CURSOR#2242680
CURSOR#2342680
CURSOR#2442680
CURSOR#2542680
CURSOR#2642680
CURSOR#2742680
CURSOR#2842680
CURSOR#2942680
CURSOR#30169400
CURSOR#3196440
CURSOR#3242680
CURSOR#33169400
CURSOR#3496440
CURSOR#3542680
CURSOR#36169400
CURSOR#3796440
CURSOR#3842680
CURSOR#39169400
CURSOR#4096440
CURSOR#4142680
GROUP_CURSOR#40790480
GROUP_CURSOR#40791480
GROUP_CURSOR#40792480
GROUP_CURSOR#40793480
GROUP_CURSOR#40794480
GROUP_CURSOR#40795480
GROUP_CURSOR#40796200
GROUP_CURSOR#40797200
GROUP_CURSOR#40798200
GROUP_CURSOR#40799200
GROUP_CURSOR#40800200
GROUP_CURSOR#40801200
GROUP_CURSOR#40802200
GROUP_CURSOR#40803200
GROUP_CURSOR#40804200
GROUP_CURSOR#40805200
GROUP_CURSOR#40806200
GROUP_CURSOR#40807480
GROUP_CURSOR#40808480
GROUP_CURSOR#40809480
GROUP_CURSOR#40810480
VERSION#112160
module_namehintordfunction_name
ADVAPI32.dll129ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll240DuplicateToken
ADVAPI32.dll289EventRegister
ADVAPI32.dll291EventUnregister
ADVAPI32.dll292EventWrite
ADVAPI32.dll368GetTokenInformation
ADVAPI32.dll369GetTraceEnableFlags
ADVAPI32.dll370GetTraceEnableLevel
ADVAPI32.dll371GetTraceLoggerHandle
ADVAPI32.dll398InitializeAcl
ADVAPI32.dll399InitializeSecurityDescriptor
ADVAPI32.dll533OpenProcessToken
ADVAPI32.dll603RegCloseKey
ADVAPI32.dll612RegCreateKeyExW
ADVAPI32.dll634RegEnumKeyExW
ADVAPI32.dll652RegOpenKeyExW
ADVAPI32.dll659RegQueryInfoKeyW
ADVAPI32.dll664RegQueryValueExA
ADVAPI32.dll665RegQueryValueExW
ADVAPI32.dll693RegisterTraceGuidsW
ADVAPI32.dll744SetSecurityDescriptorDacl
ADVAPI32.dll803SystemFunction036
ADVAPI32.dll806TraceEvent
ADVAPI32.dll821UnregisterTraceGuids
KERNEL32.dllAcquireSRWLockExclusive
KERNEL32.dll21AllocConsole
KERNEL32.dll37AttachConsole
KERNEL32.dll113CallbackMayRunLong
KERNEL32.dll115CancelIo
KERNEL32.dll137CloseHandle
KERNEL32.dll143CloseThreadpool
KERNEL32.dll149CloseThreadpoolWork
KERNEL32.dll158CompareStringW
KERNEL32.dll159ConnectNamedPipe
KERNEL32.dll189CreateDirectoryW
KERNEL32.dll194CreateEventW
KERNEL32.dll198CreateFileA
KERNEL32.dll203CreateFileMappingW
KERNEL32.dll206CreateFileW
KERNEL32.dll211CreateIoCompletionPort
KERNEL32.dll223CreateNamedPipeW
KERNEL32.dll246CreateThread
KERNEL32.dll247CreateThreadpool
KERNEL32.dll252CreateThreadpoolWork
KERNEL32.dll255CreateToolhelp32Snapshot
KERNEL32.dll268DecodePointer
KERNEL32.dll275DeleteCriticalSection
KERNEL32.dll280DeleteFileW
KERNEL32.dll288DeviceIoControl
KERNEL32.dll302DuplicateHandle
KERNEL32.dll304EncodePointer
KERNEL32.dll308EnterCriticalSection
KERNEL32.dll343EnumSystemLocalesW
KERNEL32.dll353ExitProcess
KERNEL32.dll354ExitThread
KERNEL32.dll357ExpandEnvironmentStringsW
KERNEL32.dll365FileTimeToSystemTime
KERNEL32.dll376FindClose
KERNEL32.dll382FindFirstFileExW
KERNEL32.dll399FindNextFileW
KERNEL32.dll413FlsAlloc
KERNEL32.dll416FlsSetValue
KERNEL32.dll418FlushFileBuffers
KERNEL32.dll419FlushInstructionCache
KERNEL32.dll425FormatMessageA
KERNEL32.dll426FormatMessageW
KERNEL32.dll429FreeEnvironmentStringsW
KERNEL32.dll430FreeLibrary
KERNEL32.dll431FreeLibraryAndExitThread
KERNEL32.dll437GetACP
KERNEL32.dll452GetCPInfo
KERNEL32.dll473GetCommandLineA
KERNEL32.dll474GetCommandLineW
KERNEL32.dll482GetComputerNameW
KERNEL32.dll511GetConsoleMode
KERNEL32.dll515GetConsoleOutputCP
KERNEL32.dll532GetCurrentDirectoryW
KERNEL32.dll538GetCurrentProcess
KERNEL32.dll539GetCurrentProcessId
KERNEL32.dll542GetCurrentThread
KERNEL32.dll543GetCurrentThreadId
KERNEL32.dll548GetDateFormatW
KERNEL32.dll562GetDriveTypeW
KERNEL32.dll570GetEnvironmentStringsW
KERNEL32.dll572GetEnvironmentVariableW
KERNEL32.dll581GetFileAttributesExW
KERNEL32.dll584GetFileAttributesW
KERNEL32.dll586GetFileInformationByHandle
KERNEL32.dll591GetFileSizeEx
KERNEL32.dll593GetFileType
KERNEL32.dll604GetFullPathNameW
KERNEL32.dll612GetLastError
KERNEL32.dll613GetLocalTime
KERNEL32.dll616GetLocaleInfoW
KERNEL32.dll631GetModuleFileNameW
KERNEL32.dll632GetModuleHandleA
KERNEL32.dll634GetModuleHandleExW
KERNEL32.dll635GetModuleHandleW
KERNEL32.dll648GetNativeSystemInfo
KERNEL32.dll666GetOEMCP
KERNEL32.dll689GetProcAddress
KERNEL32.dll695GetProcessHeap
KERNEL32.dll697GetProcessId
KERNEL32.dll705GetProcessTimes
KERNEL32.dll710GetProductInfo
KERNEL32.dll717GetQueuedCompletionStatus
KERNEL32.dll723GetStartupInfoW
KERNEL32.dll725GetStdHandle
KERNEL32.dll730GetStringTypeW
KERNEL32.dll734GetSystemDefaultLCID
KERNEL32.dll739GetSystemDirectoryW
KERNEL32.dll741GetSystemFirmwareTable
KERNEL32.dll742GetSystemInfo
KERNEL32.dll748GetSystemTimeAsFileTime
KERNEL32.dll750GetSystemTimes
KERNEL32.dll761GetTempPathW
KERNEL32.dll762GetThreadContext
KERNEL32.dll767GetThreadId
KERNEL32.dll770GetThreadLocale
KERNEL32.dll772GetThreadPriority
KERNEL32.dll778GetTickCount
KERNEL32.dll783GetTimeFormatW
KERNEL32.dll785GetTimeZoneInformation
KERNEL32.dll789GetUserDefaultLCID
KERNEL32.dll798GetVersionExW
KERNEL32.dll809GetWindowsDirectoryW
KERNEL32.dll829GlobalMemoryStatusEx
KERNEL32.dll848HeapSetInformation
KERNEL32.dll860InitOnceExecuteOnce
KERNEL32.dll862InitializeConditionVariable
KERNEL32.dll866InitializeCriticalSectionAndSpinCount
KERNEL32.dll870InitializeSListHead
KERNEL32.dll879InterlockedFlushSList
KERNEL32.dll898IsDebuggerPresent
KERNEL32.dll905IsProcessorFeaturePresent
KERNEL32.dll911IsValidCodePage
KERNEL32.dll913IsValidLocale
KERNEL32.dll917IsWow64Process
KERNEL32.dll937K32GetPerformanceInfo
KERNEL32.dll940K32GetProcessMemoryInfo
KERNEL32.dll944K32QueryWorkingSet
KERNEL32.dll945K32QueryWorkingSetEx
KERNEL32.dll949LCMapStringW
KERNEL32.dll961LeaveCriticalSection
KERNEL32.dll966LoadLibraryExA
KERNEL32.dll967LoadLibraryExW
KERNEL32.dll968LoadLibraryW
KERNEL32.dll979LocalFree
KERNEL32.dll994MapViewOfFile
KERNEL32.dll1011MultiByteToWideChar
KERNEL32.dll1039OpenProcess
KERNEL32.dll1046OpenThread
KERNEL32.dll1050OutputDebugStringA
KERNEL32.dll1061PostQueuedCompletionStatus
KERNEL32.dll1070Process32FirstW
KERNEL32.dll1072Process32NextW
KERNEL32.dll1103QueryPerformanceCounter
KERNEL32.dll1104QueryPerformanceFrequency
KERNEL32.dll1108QueryThreadCycleTime
KERNEL32.dll1124RaiseException
KERNEL32.dll1138ReadConsoleW
KERNEL32.dll1141ReadFile
KERNEL32.dll1144ReadProcessMemory
KERNEL32.dll1204ReleaseSRWLockExclusive
KERNEL32.dll1211RemoveDirectoryW
KERNEL32.dll1224ResetEvent
KERNEL32.dll1231ResumeThread
KERNEL32.dll1233RtlCaptureStackBackTrace
KERNEL32.dll1237RtlUnwind
KERNEL32.dll1259SetConsoleCtrlHandler
KERNEL32.dll1291SetCurrentDirectoryW
KERNEL32.dll1298SetEndOfFile
KERNEL32.dll1302SetEnvironmentVariableW
KERNEL32.dll1304SetEvent
KERNEL32.dll1311SetFileAttributesW
KERNEL32.dll1317SetFilePointerEx
KERNEL32.dll1332SetLastError
KERNEL32.dll1354SetProcessWorkingSetSize
KERNEL32.dll1358SetStdHandle
KERNEL32.dll1378SetThreadPriority
KERNEL32.dll1385SetThreadpoolThreadMaximum
KERNEL32.dll1386SetThreadpoolThreadMinimum
KERNEL32.dll1393SetUnhandledExceptionFilter
KERNEL32.dll1409Sleep
KERNEL32.dll1411SleepConditionVariableSRW
KERNEL32.dll1416SubmitThreadpoolWork
KERNEL32.dll1417SuspendThread
KERNEL32.dll1420SystemTimeToFileTime
KERNEL32.dll1421SystemTimeToTzSpecificLocalTime
KERNEL32.dll1424TerminateProcess
KERNEL32.dll1442TlsAlloc
KERNEL32.dll1443TlsFree
KERNEL32.dll1444TlsGetValue
KERNEL32.dll1445TlsSetValue
KERNEL32.dll1449TryAcquireSRWLockExclusive
KERNEL32.dll1453TzSpecificLocalTimeToSystemTime
KERNEL32.dll1457UnhandledExceptionFilter
KERNEL32.dll1460UnmapViewOfFile
KERNEL32.dll1467UnregisterWaitEx
KERNEL32.dll1477VerSetConditionMask
KERNEL32.dll1481VerifyVersionInfoW
KERNEL32.dll1482VirtualAlloc
KERNEL32.dll1485VirtualFree
KERNEL32.dll1488VirtualProtect
KERNEL32.dll1490VirtualQuery
KERNEL32.dll1491VirtualQueryEx
KERNEL32.dll1497WaitForMultipleObjects
KERNEL32.dll1499WaitForSingleObject
KERNEL32.dll1500WaitForSingleObjectEx
KERNEL32.dll1504WaitForThreadpoolWorkCallbacks
KERNEL32.dll1506WaitNamedPipeW
KERNEL32.dll1507WakeAllConditionVariable
KERNEL32.dll1508WakeConditionVariable
KERNEL32.dll1538WideCharToMultiByte
KERNEL32.dll1557WriteConsoleW
KERNEL32.dll1558WriteFile
pdh.dll1PdhAddCounterW
pdh.dll3PdhAddEnglishCounterW
pdh.dll13PdhCloseQuery
pdh.dll14PdhCollectQueryData
pdh.dll42PdhFormatFromRawValue
pdh.dll44PdhGetCounterInfoW
pdh.dll66PdhGetRawCounterArrayW
pdh.dll80PdhOpenQueryW
pdh.dll87PdhRemoveCounter
dbghelp.dll53SymCleanup
dbghelp.dll90SymFromAddr
dbghelp.dll109SymGetLineFromAddr64
dbghelp.dll134SymGetSearchPathW
dbghelp.dll160SymInitialize
dbghelp.dll189SymSetOptions
dbghelp.dll195SymSetSearchPathW
dxgi.dll4CreateDXGIFactory1
WS2_32.dll111
WS2_32.dll115
WS2_32.dll57
ole32.dll39CoCreateGuid
ole32.dll93CoInitialize
ole32.dll94CoInitializeEx
ole32.dll116CoRegisterInitializeSpy
ole32.dll128CoRevokeInitializeSpy
ole32.dll137CoTaskMemFree
ole32.dll141CoUninitialize
IPHLPAPI.DLL68GetAdaptersInfo
SHLWAPI.dll127PathMatchSpecW
SHLWAPI.dll199SHGetValueW
SHELL32.dll8CommandLineToArgvW
SHELL32.dll335SHGetFolderPathW
SHELL32.dll345SHGetKnownFolderPath
VERSION.dll7GetFileVersionInfoSizeW
VERSION.dll8GetFileVersionInfoW
VERSION.dll16VerQueryValueW
USER32.dll118CreateWindowExW
USER32.dll167DefWindowProcW
USER32.dll181DestroyWindow
USER32.dll189DispatchMessageW
USER32.dll432GetQueueStatus
USER32.dll453GetSystemMetrics
USER32.dll485GetWindowLongW
USER32.dll588KillTimer
USER32.dll656MsgWaitForMultipleObjectsEx
USER32.dll679PeekMessageW
USER32.dll683PostMessageW
USER32.dll684PostQuitMessage
USER32.dll730RegisterClassExW
USER32.dll869SetTimer
USER32.dll881SetWindowLongW
USER32.dll933TranslateMessage
USER32.dll944UnregisterClassW
WINMM.dll144timeBeginPeriod
WINMM.dll145timeEndPeriod
WINMM.dll148timeGetTime
CRYPT32.dll230CryptUnprotectData
ordentry_vafunction_name
10x171cb0??0CommandDispatcher@backend@@QAE@ABV01@@Z
20x171ca0??0CommandDispatcher@backend@@QAE@XZ
30x10d50??1CommandDispatcher@backend@@UAE@XZ
40x171c90??4CommandDispatcher@backend@@QAEAAV01@ABV01@@Z
50x4154fc??_7CommandDispatcher@backend@@6B@
60x246500GetHandleVerifier
70x116ee0LarkMain
80x117160ServiceMain
module_namebackend.dll
flags0
timestamp0
version0.0
ordinal_base0
nFunctions9
nNames8
Names(8)0x47fe2f
Functions(9)0x47fe0b
NameOrdinals(8)0x47fe4f

StringTable 040904b0

CompanyNameBeijing Feishu Technology Co., Ltd.
FileDescriptionbackend
FileVersion6.2.0.72
InternalNamebackend
LegalCopyrightCopyright(C) 2022 Beijing Feishu Technology Co., Ltd. All rights reserved.
OriginalFilenamebackend.dll
ProductNamebackend
ProductVersion6.2.0.72
CompanyShortNameBeijing Feishu Technology Co., Ltd.
ProductShortNamebackend
LastChangee98e6f21168a55e7ba57202f56323911cd9d31d1-refs/branch-heads/4044@{#883}
Official Build1

VS_FIXEDFILEINFO

FileVersion6.2.0.72
ProductVersion6.2.0.72
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d05235760BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0x48b690