filenameArab.dll
size12288 (0x3000)
md5f934a55e504983ccd29b1c7dadd968ff
typePE32 executable (DLL) (Windows CE) ARM Thumb, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
109507253
001
110507252
123507012
109605116
123507277
1039
110605114
122507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x1c2
NumberOfSections5
TimeDateStamp0x4a2734a3
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion8.0
SizeOfCode0x1200
SizeOfInitializedData0x1a00
SizeOfUninitializedData0
AddressOfEntryPoint0x1b5c
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x100000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.10
Reserved10
SizeOfImage0x7000
SizeOfHeaders0x400
CheckSum0
Subsystem9
DllCharacteristics0
SizeOfStackReserve0x10000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x11c00x1200R-X CODE
.rdata0x30000x5100x600R-- IDATA
.data0x40000xcdc0xe00RW- IDATA
.pdata0x50000x1200x200R-- IDATA
.reloc0x60000x3460x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x33d00x140
IMPORT0x32800x50
RESOURCE00
EXCEPTION0x50000x120
SECURITY00
BASERELOC0x60000x190
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x40000x80
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
MultiLanDll.dll6class ATL::CStringT<wchar_t, class StrTraitMFC_DLL<wchar_t, class ATL::ChTraitsOS<wchar_t> > > __cdecl GetLanguage(void)

?GetLanguage@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsOS@_W@ATL@@@@@ATL@@XZ

MFC80U.DLL902
MFC80U.DLL520
MFC80U.DLL2836
MFC80U.DLL287
MFC80U.DLL2175
MFC80U.DLL1580
MFC80U.DLL419
MFC80U.DLL903
MFC80U.DLL518
MFC80U.DLL549
MFC80U.DLL1235
MFC80U.DLL276
COREDLL.dll63
COREDLL.dll1177
COREDLL.dll1232
COREDLL.dll544
COREDLL.dll2696
COREDLL.dll1049
COREDLL.dll1041
COREDLL.dll1054
COREDLL.dll1645
COREDLL.dll1018
COREDLL.dll2
COREDLL.dll3
COREDLL.dll2512
COREDLL.dll1876
COREDLL.dll1047
COREDLL.dll87
ordentry_vafunction_name
10x1254?ArabicReverse@@YAXAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsOS@_W@ATL@@@@@ATL@@@Z
20x16b4?DispRightToLeft@@YA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsOS@_W@ATL@@@@@ATL@@PB_W@Z
30x1000?isFromTheSet1@@YAH_W@Z
40x1038?isFromTheSet2@@YAH_W@Z
module_nameArab.dll
flags0
timestamp2009-06-04 02:42:43
version0.0
ordinal_base1
nFunctions4
nNames4
Names(4)0x3408
Functions(4)0x33f8
NameOrdinals(4)0x3418
offsetsizetypecomment
012288DLL06/04/2009 02:42:43#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK