filenameEDFA4B770626C0161BAEB41B6B17A830
size396800 (0x60e00)
md5edfa4b770626c0161baeb41b6b17a830
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
10227
93403519
15403518
95403562
9240351
96403567
9440351
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4e98a300
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion7.10
SizeOfCode0x56c00
SizeOfInitializedData0xb000
SizeOfUninitializedData0
AddressOfEntryPoint0x2f116
BaseOfCode0x1000
BaseOfData0x58000
ImageBase0x4bb30000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion5.2
SubsystemVersion4.0
Reserved10
SizeOfImage0x64000
SizeOfHeaders0x400
CheckSum0x70b65
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MSVC++ DLL v.8 (typical OEP recognized - h)

Sections

namevavsizeraw sizeflags
.text0x10000x56a330x56c00R-X CODE
.data0x580000x31280x2000RW- IDATA
.rsrc0x5c0000x3cc00x3e00R-- IDATA
.reloc0x600000x3e3e0x4000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x579900xa3
IMPORT0x56b080xb4
RESOURCE0x5c0000x3cc0
EXCEPTION00
SECURITY00
BASERELOC0x600000x2ecc
DEBUG0x12f00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x1dec00x40
Bound_IAT00
IAT0x10000x2d8
Delay_IAT00
CLR_Header00
typenamesizecp
RT_TEXTCOPPKEY.XML37030
TYPELIB#191240
DIALOG#1061180
DIALOG#1071060
DIALOG#2061180
DIALOG#2071060
DIALOG#3061100
DIALOG#3071060
STRING#7580
STRING#13580
STRING#19500
STRING#32440
VERSION#19800
idlangstring
1011033Encrypter
1021033Tags
2011033Decrypter
2021033Tags
3011033Codec
3021033Tags
5001033EncDec
module_namehintordfunction_name
msvcrt.dll564_wcsicmp
msvcrt.dll832wcsstr
msvcrt.dll799swscanf
msvcrt.dll511_strcmpi
msvcrt.dll747memmove
msvcrt.dll66_CIpow
msvcrt.dll830wcsrchr
msvcrt.dll820wcscmp
msvcrt.dll111__dllonexit
msvcrt.dll822wcscpy
msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll825wcslen
msvcrt.dll458_purecall
msvcrt.dll85__CxxFrameHandler
msvcrt.dll689free
msvcrt.dll778strchr
msvcrt.dll787strncmp
msvcrt.dll762realloc
msvcrt.dll740malloc
msvcrt.dll445_onexit
msvcrt.dll19void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll568_wcsnicmp
msvcrt.dll640_wtol
msvcrt.dll819wcschr
msvcrt.dll829wcspbrk
msvcrt.dll827wcsncmp
msvcrt.dll555_vsnwprintf
msvcrt.dll244_except_handler3
msvcrt.dll53void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll189_adjust_fdiv
msvcrt.dll322_initterm
msvcrt.dll803time
ADVAPI32.dll517RegSetValueExA
ADVAPI32.dll504RegQueryValueExA
ADVAPI32.dll466RegCreateKeyExA
ADVAPI32.dll483RegEnumValueW
ADVAPI32.dll468RegCreateKeyW
ADVAPI32.dll519RegSetValueW
ADVAPI32.dll480RegEnumKeyExW
ADVAPI32.dll472RegDeleteKeyW
ADVAPI32.dll474RegDeleteValueW
ADVAPI32.dll518RegSetValueExW
ADVAPI32.dll505RegQueryValueExW
ADVAPI32.dll460RegCloseKey
ADVAPI32.dll467RegCreateKeyExW
ADVAPI32.dll494RegOpenKeyExW
KERNEL32.dll864TerminateProcess
KERNEL32.dll322GetCurrentProcess
KERNEL32.dll880UnhandledExceptionFilter
KERNEL32.dll844SetUnhandledExceptionFilter
KERNEL32.dll139DisableThreadLibraryCalls
KERNEL32.dll975lstrlenW
KERNEL32.dll629MultiByteToWideChar
KERNEL32.dll974lstrlenA
KERNEL32.dll369GetLastError
KERNEL32.dll381GetModuleFileNameA
KERNEL32.dll556InterlockedIncrement
KERNEL32.dll248FreeLibrary
KERNEL32.dll552InterlockedDecrement
KERNEL32.dll597LoadLibraryW
KERNEL32.dll547InitializeCriticalSection
KERNEL32.dll129DeleteCriticalSection
KERNEL32.dll152EnterCriticalSection
KERNEL32.dll593LeaveCriticalSection
KERNEL32.dll972lstrcpynW
KERNEL32.dll52CloseHandle
KERNEL32.dll80CreateEventW
KERNEL32.dll790SetEvent
KERNEL32.dll458GetSystemTimeAsFileTime
KERNEL32.dll707ReleaseSemaphore
KERNEL32.dll453GetSystemInfo
KERNEL32.dll901VirtualFree
KERNEL32.dll963lstrcmpW
KERNEL32.dll108CreateSemaphoreW
KERNEL32.dll899VirtualAlloc
KERNEL32.dll416GetProcAddress
KERNEL32.dll386GetModuleHandleW
KERNEL32.dll969lstrcpyW
KERNEL32.dll553InterlockedExchange
KERNEL32.dll838SetThreadPriority
KERNEL32.dll111CreateThread
KERNEL32.dll604LocalFree
KERNEL32.dll918WideCharToMultiByte
KERNEL32.dll456GetSystemTime
KERNEL32.dll856Sleep
KERNEL32.dll323GetCurrentProcessId
KERNEL32.dll326GetCurrentThreadId
KERNEL32.dll479GetTickCount
KERNEL32.dll676QueryPerformanceFrequency
KERNEL32.dll675QueryPerformanceCounter
KERNEL32.dll679RaiseException
KERNEL32.dll572IsProcessorFeaturePresent
KERNEL32.dll550InterlockedCompareExchange
KERNEL32.dll912WaitForMultipleObjects
KERNEL32.dll914WaitForSingleObject
KERNEL32.dll490GetVersionExW
KERNEL32.dll934WriteFile
KERNEL32.dll86CreateFileW
KERNEL32.dll796SetFilePointer
KERNEL32.dll693ReadFile
KERNEL32.dll540HeapSize
KERNEL32.dll600LocalAlloc
KERNEL32.dll371GetLocalTime
KERNEL32.dll516GlobalMemoryStatus
KERNEL32.dll333GetDiskFreeSpaceA
KERNEL32.dll343GetEnvironmentStringsW
KERNEL32.dll341GetEnvironmentStrings
KERNEL32.dll247FreeEnvironmentStringsW
KERNEL32.dll246FreeEnvironmentStringsA
KERNEL32.dll138DeviceIoControl
KERNEL32.dll489GetVersionExA
KERNEL32.dll383GetModuleHandleA
KERNEL32.dll355GetFileSize
KERNEL32.dll511GlobalFree
KERNEL32.dll522GlobalUnlock
KERNEL32.dll515GlobalLock
KERNEL32.dll504GlobalAlloc
KERNEL32.dll59CompareStringW
KERNEL32.dll719ResetEvent
KERNEL32.dll382GetModuleFileNameW
KERNEL32.dll534HeapFree
KERNEL32.dll419GetProcessHeap
KERNEL32.dll528HeapAlloc
KERNEL32.dll97CreateMutexW
KERNEL32.dll706ReleaseMutex
KERNEL32.dll594LoadLibraryA
ole32.dll16CoCreateInstance
ole32.dll100CoTaskMemAlloc
ole32.dll309StringFromGUID2
ole32.dll105CoUninitialize
ole32.dll28CoFreeUnusedLibraries
ole32.dll59CoInitialize
ole32.dll101CoTaskMemFree
ole32.dll60CoInitializeEx
OLEAUT32.dll7
OLEAUT32.dll12
OLEAUT32.dll10
OLEAUT32.dll9
OLEAUT32.dll149
OLEAUT32.dll6
OLEAUT32.dll2
OLEAUT32.dll4
OLEAUT32.dll8
WS2_32.dll14
WS2_32.dll8
WS2_32.dll15
USER32.dll728wsprintfW
USER32.dll367GetWindowLongW
USER32.dll641SetWindowLongW
USER32.dll86CreateDialogParamW
USER32.dll492MoveWindow
USER32.dll437KillTimer
USER32.dll634SetTimer
USER32.dll727wsprintfA
USER32.dll403InvalidateRect
USER32.dll658ShowWindow
USER32.dll153DestroyWindow
USER32.dll460LoadStringW
USER32.dll372GetWindowRect
USER32.dll270GetDesktopWindow
USER32.dll143DefWindowProcW
DRMClien.DLL4
DRMClien.DLL5public: long __thiscall CDRMLiteCrypto::EncryptIndirectFast(char const *, unsigned long, unsigned char *, unsigned char *)

?EncryptIndirectFast@CDRMLiteCrypto@@QAEJPBDKPAE1@Z

DRMClien.DLL19
DRMClien.DLL6
DRMClien.DLL3
DRMClien.DLL9
DRMClien.DLL6public: long __thiscall CDRMLiteCrypto::GenerateNewLicenseEx(unsigned long, unsigned char *, unsigned char *, unsigned char *, char * *, char * *, unsigned char *)

?GenerateNewLicenseEx@CDRMLiteCrypto@@QAEJKPAE00PAPAD10@Z

DRMClien.DLL1public: __thiscall CDRMLiteCrypto::~CDRMLiteCrypto(void)

??1CDRMLiteCrypto@@QAE@XZ

DRMClien.DLL20
DRMClien.DLL7
DRMClien.DLLpublic: __thiscall CDRMLiteCrypto::CDRMLiteCrypto(void)

??0CDRMLiteCrypto@@QAE@XZ

DRMClien.DLL5
ordentry_vafunction_name
10x1ed8fDllCanUnloadNow
20x1ee1bDllGetClassObject
30x1e12aDllRegisterServer
40x1e28cDllUnregisterServer
module_nameencdec.dll
flags0
timestamp2011-10-14 12:32:59
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x579c8
Functions(4)0x579b8
NameOrdinals(4)0x579d8

StringTable 040904E4

CompanyNameMicrosoft Corporation
FileDescription(No COPP Allowed) XDSCodec & Encypter/Decrypter Tagger Filters.
FileVersion6.05.3790.4916
InternalNameEncDec.dll
LegalCopyrightCopyright (C) 1992-2001 Microsoft Corp.
OriginalFilenameEncDec.dll
ProductNameDirectShow
ProductVersion6.05.3790.4916
DirectShowCore
OLESelfRegisterDXM20

VS_FIXEDFILEINFO

FileVersion6.5.3790.4916
ProductVersion6.5.3790.4916
StrucVersion0x10000
FileFlagsMask0x30003f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
0396800DLL10/14/2011 21:00:48#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK