filenameEF1F4C12D259C3FB7C76992DC91A920D
size155648 (0x26000)
md5ef1f4c12d259c3fb7c76992dc91a920d
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x118

Rich Header

lib idversiontimes used
3787552
1181681
10816823
008
1472993
9620674
5489712
6492108
10158
25921015
2891787
6392101
6991111
29917828
6192101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x3d6ddec6
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x210e
Magic0x10b
LinkerVersion7.0
SizeOfCode0x21400
SizeOfInitializedData0x5000
SizeOfUninitializedData0
AddressOfEntryPoint0x48b0
BaseOfCode0x1000
BaseOfData0x23000
ImageBase0x1ff00000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x2a000
SizeOfHeaders0x400
CheckSum0x29e27
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x213230x21400R-X CODE
.data0x230000xa380x400RW- IDATA
.CRT0x2400040x200RW- IDATA
.rsrc0x250000x27900x2800R-- IDATA
.reloc0x280000x18ec0x1a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x222800xa3
IMPORT0x218200xb4
RESOURCE0x250000x2790
EXCEPTION00
SECURITY00
BASERELOC0x280000x1220
DEBUG0x11f00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2d80xb0
IAT0x10000x1e8
Delay_IAT00
CLR_Header00
typenamesizecp
TYPELIB#175600
DIALOG#1061180
DIALOG#1071060
DIALOG#2061180
DIALOG#2071060
DIALOG#3061100
DIALOG#3071060
STRING#7580
STRING#13580
STRING#19500
STRING#32440
VERSION#19440
idlangstring
1011033Encrypter
1021033Tags
2011033Decrypter
2021033Tags
3011033Codec
3021033Tags
5001033EncDec
module_namehintordfunction_name
msvcrt.dll18void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll52void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll16public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll237_except_handler3
msvcrt.dll774strncmp
msvcrt.dll280_ftol
msvcrt.dll790time
msvcrt.dll82__CxxFrameHandler
msvcrt.dll812wcslen
msvcrt.dll17void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll809wcscpy
KERNEL32.dll433GetSystemInfo
KERNEL32.dll870VirtualFree
KERNEL32.dll929lstrcmpW
KERNEL32.dll311GetCurrentThreadId
KERNEL32.dll102CreateSemaphoreW
KERNEL32.dll867VirtualAlloc
KERNEL32.dll400GetProcAddress
KERNEL32.dll682ReleaseSemaphore
KERNEL32.dll806SetThreadPriority
KERNEL32.dll458GetTickCount
KERNEL32.dll105CreateThread
KERNEL32.dll887WideCharToMultiByte
KERNEL32.dll580LocalFree
KERNEL32.dll90CreateMutexA
KERNEL32.dll681ReleaseMutex
KERNEL32.dll576LocalAlloc
KERNEL32.dll262GetComputerNameA
KERNEL32.dll318GetDiskFreeSpaceA
KERNEL32.dll495GlobalMemoryStatus
KERNEL32.dll355GetLocalTime
KERNEL32.dll309GetCurrentProcessId
KERNEL32.dll131DeviceIoControl
KERNEL32.dll570LoadLibraryA
KERNEL32.dll468GetVersionExA
KERNEL32.dll883WaitForSingleObject
KERNEL32.dll881WaitForMultipleObjects
KERNEL32.dll762SetEvent
KERNEL32.dll74CreateEventW
KERNEL32.dll47CloseHandle
KERNEL32.dll938lstrcpynW
KERNEL32.dll569LeaveCriticalSection
KERNEL32.dll143EnterCriticalSection
KERNEL32.dll122DeleteCriticalSection
KERNEL32.dll526InitializeCriticalSection
KERNEL32.dll530InterlockedDecrement
KERNEL32.dll233FreeLibrary
KERNEL32.dll534InterlockedIncrement
KERNEL32.dll364GetModuleFileNameA
KERNEL32.dll353GetLastError
KERNEL32.dll940lstrlenA
KERNEL32.dll605MultiByteToWideChar
KERNEL32.dll941lstrlenW
KERNEL32.dll132DisableThreadLibraryCalls
KERNEL32.dll651QueryPerformanceFrequency
KERNEL32.dll650QueryPerformanceCounter
KERNEL32.dll469GetVersionExW
KERNEL32.dll369GetModuleHandleW
USER32.dll153DestroyWindow
USER32.dll143DefWindowProcW
USER32.dll457LoadStringW
USER32.dll372GetWindowRect
USER32.dll403InvalidateRect
USER32.dll658ShowWindow
USER32.dll434KillTimer
USER32.dll489MoveWindow
USER32.dll86CreateDialogParamW
USER32.dll641SetWindowLongW
USER32.dll367GetWindowLongW
USER32.dll729wsprintfW
USER32.dll270GetDesktopWindow
USER32.dll634SetTimer
ADVAPI32.dll482RegOpenKeyExW
ADVAPI32.dll456RegCloseKey
ADVAPI32.dll492RegQueryValueExW
ADVAPI32.dll505RegSetValueExW
ADVAPI32.dll466RegDeleteValueW
ADVAPI32.dll464RegDeleteKeyW
ADVAPI32.dll470RegEnumKeyExW
ADVAPI32.dll506RegSetValueW
ADVAPI32.dll462RegCreateKeyW
ADVAPI32.dll289GetUserNameA
ADVAPI32.dll491RegQueryValueExA
ADVAPI32.dll504RegSetValueExA
ADVAPI32.dll460RegCreateKeyExA
ADVAPI32.dll461RegCreateKeyExW
ole32.dll99CoTaskMemFree
ole32.dll58CoInitializeEx
ole32.dll28CoFreeUnusedLibraries
ole32.dll103CoUninitialize
ole32.dll322StringFromGUID2
ole32.dll98CoTaskMemAlloc
ole32.dll16CoCreateInstance
ole32.dll57CoInitialize
OLEAUT32.dll7
OLEAUT32.dll4
OLEAUT32.dll6
OLEAUT32.dll2
OLEAUT32.dll149
ntdll.dll1310_strcmpi
ntdll.dll16DbgPrint
ntdll.dll15DbgBreakPoint
DRMClien.DLL5public: long __thiscall CDRMLiteCrypto::GenerateNewLicenseEx(unsigned long, unsigned char *, unsigned char *, unsigned char *, char * *, char * *, unsigned char *)

?GenerateNewLicenseEx@CDRMLiteCrypto@@QAEJKPAE00PAPAD10@Z

DRMClien.DLL6
DRMClien.DLL4public: long __thiscall CDRMLiteCrypto::EncryptIndirectFast(char const *, unsigned long, unsigned char *, unsigned char *)

?EncryptIndirectFast@CDRMLiteCrypto@@QAEJPBDKPAE1@Z

DRMClien.DLL5
DRMClien.DLL19
DRMClien.DLL1public: __thiscall CDRMLiteCrypto::~CDRMLiteCrypto(void)

??1CDRMLiteCrypto@@QAE@XZ

DRMClien.DLL20
DRMClien.DLL7
DRMClien.DLLpublic: __thiscall CDRMLiteCrypto::CDRMLiteCrypto(void)

??0CDRMLiteCrypto@@QAE@XZ

DRMClien.DLL9
DRMClien.DLL3
DRMClien.DLL4
ordentry_vafunction_name
10x530aDllCanUnloadNow
20x5362DllGetClassObject
30x48b5DllRegisterServer
40x4a0cDllUnregisterServer
module_nameencdec.dll
flags0
timestamp2002-08-29 07:02:29
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x222b8
Functions(4)0x222a8
NameOrdinals(4)0x222c8

StringTable 040904E4

CompanyNameMicrosoft Corporation
FileDescriptionXDSCodec & Encypter/Decrypter Tagger Filters.
FileVersion6.04.2600.1106
InternalNameEncDec.dll
LegalCopyrightCopyright (C) 1992-2001 Microsoft Corp.
OriginalFilenameEncDec.dll
ProductNameDirectShow
ProductVersion6.04.2600.1106
DirectShowCore
OLESelfRegisterDXM20

VS_FIXEDFILEINFO

FileVersion6.4.2600.1106
ProductVersion6.4.2600.1106
StrucVersion0x10000
FileFlagsMask0x30003f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
0155648DLL08/29/2002 08:43:50#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2d8