filenamelbm_logwrite.dll
size23552 (0x5c00)
md5f5c8774186ebb8f8e156f5a2a398921b
typePE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
150204131
149307292
1313072911
132307293
123507272
147307295
1061
138307291
146307291
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections7
TimeDateStamp0x5332987c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x2022
Magic0x20b
LinkerVersion9.0
SizeOfCode0x2800
SizeOfInitializedData0x3000
SizeOfUninitializedData0
AddressOfEntryPoint0x2ed0
BaseOfCode0x1000
ImageBase0x180000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.2
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0xb000
SizeOfHeaders0x400
CheckSum0x14e04
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x26860x2800R-X CODE
.rdata0x40000x13c60x1400R-- IDATA
.data0x60000x6080x200RW- IDATA
.pdata0x70000x30c0x400R-- IDATA
dllShare0x80000xa300xc00RW- IDATA SHARED
.rsrc0x90000x6940x800R-- IDATA
.reloc0xa0000x540x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x52a00x126
IMPORT0x4c400x50
RESOURCE0x90000x694
EXCEPTION0x70000x30c
SECURITY00
BASERELOC0xa0000x20
DEBUG0x42400x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000x200
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19241252
MANIFEST#26001252
module_namehintordfunction_name
shareapi.dll11KPMS_ProcessSynLock
shareapi.dllKPMS_CreatProcessSynLock
shareapi.dll9KPMS_PSynUnLock
shareapi.dll15KPMS_ReleaseProcessSyn
KERNEL32.dll614GetTickCount
KERNEL32.dll912RtlLookupFunctionEntry
KERNEL32.dll919RtlVirtualUnwind
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll846QueryPerformanceCounter
KERNEL32.dll847QueryPerformanceFrequency
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll715IsDebuggerPresent
KERNEL32.dll1049SetUnhandledExceptionFilter
KERNEL32.dll1090UnhandledExceptionFilter
KERNEL32.dll426GetCurrentProcess
KERNEL32.dll1073TerminateProcess
KERNEL32.dll1061Sleep
KERNEL32.dll905RtlCaptureContext
MSVCR90.dll1274printf
MSVCR90.dll1186fopen
MSVCR90.dll35void __cdecl operator delete[](void * __ptr64)

??_V@YAXPEAX@Z

MSVCR90.dll1194fread
MSVCR90.dll1188fprintf
MSVCR90.dll1314strcpy_s
MSVCR90.dll387_ftime64
MSVCR90.dll19void __cdecl operator delete(void * __ptr64)

??3@YAXPEAX@Z

MSVCR90.dll1207fwrite
MSVCR90.dll1204ftell
MSVCR90.dll571_localtime64
MSVCR90.dll1202fseek
MSVCR90.dll1173fclose
MSVCR90.dll1153atoi
MSVCR90.dll904_time64
MSVCR90.dll17void * __ptr64 __cdecl operator new(unsigned __int64)

??2@YAPEAX_K@Z

MSVCR90.dll99__CxxFrameHandler3
MSVCR90.dll932_unlock
MSVCR90.dll133__dllonexit
MSVCR90.dll311_encode_pointer
MSVCR90.dll573_lock
MSVCR90.dll740_onexit
MSVCR90.dll301_decode_pointer
MSVCR90.dll590_malloc_crt
MSVCR90.dll462_initterm
MSVCR90.dll463_initterm_e
MSVCR90.dll1196free
MSVCR90.dll312_encoded_null
MSVCR90.dll226_amsg_exit
MSVCR90.dll90__CppXcptFilter
MSVCR90.dll131__crt_debugger_hook
MSVCR90.dll123__clean_type_info_names_internal
MSVCR90.dll1176fflush
MSVCR90.dll1310strchr
MSVCR90.dll812_snprintf_s
MSVCR90.dll1302sprintf_s
MSVCR90.dll866_strnicmp
MSVCR90.dll856_stricmp
MSVCR90.dll730_mkdir
MSVCR90.dll1268memset
MSVCR90.dll1324strncpy_s
MSVCR90.dll89__C_specific_handler
ordentry_vafunction_name
10x2400CheckKCPDLogLevel
20x23e0GetMemTableShareName
30x2420GetWriteLogLevel
40x24d0KcbpWriteLog
50x2830UserWriteBinLog
60x2980UserWriteBinLogExt
70x28b0UserWriteLog
80x29a0UserWriteLogExt
90x2480WriteLogLevel
module_namelbm_logwrite.dll
flags0
timestamp2014-03-26 09:06:03
version0.0
ordinal_base1
nFunctions9
nNames9
Names(9)0x52ec
Functions(9)0x52c8
NameOrdinals(9)0x5310

StringTable 080403A8

CompanyName金证科技股份有限公司
FileDescriptionlbm_logwrite(中信证券)
FileVersion3.0.0.50
InternalName
LegalCopyrightCopyright ? 2009 金融软件中心
LegalTrademarks
PrivateBuild
SpecialBuild
OriginalFilename
ProductNamelbm_logwrite
ProductVersion3.0.0.50
CompanyName金证科技股份有限公司
LegalCopyrightCopyright ? 2009 金融软件中心

VS_FIXEDFILEINFO

FileVersion3.0.0.50
ProductVersion3.0.0.50
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d017968BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK