
dumps/sots.exe:     file format pei-i386

Characteristics 0x102
	executable
	32 bit words

Time/Date		Sun Dec 17 19:11:57 2017
Magic			010b	(PE32)
MajorLinkerVersion	10
MinorLinkerVersion	0
SizeOfCode		005dba00
SizeOfInitializedData	001ac800
SizeOfUninitializedData	00000000
AddressOfEntryPoint	00525794
BaseOfCode		00001000
BaseOfData		005dd000
ImageBase		00400000
SectionAlignment	00001000
FileAlignment		00000200
MajorOSystemVersion	5
MinorOSystemVersion	1
MajorImageVersion	0
MinorImageVersion	0
MajorSubsystemVersion	5
MinorSubsystemVersion	1
Win32Version		00000000
SizeOfImage		007b3000
SizeOfHeaders		00000400
CheckSum		0079401b
Subsystem		00000002	(Windows GUI)
DllCharacteristics	00008140
					DYNAMIC_BASE
					NX_COMPAT
					TERMINAL_SERVICE_AWARE
SizeOfStackReserve	00100000
SizeOfStackCommit	00001000
SizeOfHeapReserve	00100000
SizeOfHeapCommit	00001000
LoaderFlags		00000000
NumberOfRvaAndSizes	00000010

The Data Directory
Entry 0 00000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 006d6c84 00000154 Import Directory [parts of .idata]
Entry 2 00730000 00007924 Resource Directory [.rsrc]
Entry 3 00000000 00000000 Exception Directory [.pdata]
Entry 4 00000000 00000000 Security Directory
Entry 5 00738000 0005ddc4 Base Relocation Directory [.reloc]
Entry 6 005e0ff0 0000001c Debug Directory
Entry 7 00000000 00000000 Description Directory
Entry 8 00000000 00000000 Special Directory
Entry 9 00000000 00000000 Thread Storage Directory [.tls]
Entry a 00000000 00000000 Load Configuration Directory
Entry b 00000000 00000000 Bound Import Directory
Entry c 005dd000 00000558 Import Address Table Directory
Entry d 00000000 00000000 Delay Import Directory
Entry e 00000000 00000000 CLR Runtime Header
Entry f 00000000 00000000 Reserved

There is an import table in .rdata at 0xad6c84

The Import Tables (interpreted .rdata section contents)
 vma:            Hint    Time      Forward  DLL       First
                 Table   Stamp     Chain    Name      Thunk
 006d6c84	006d6e04 00000000 00000000 006d7342 005dd02c

	DLL Name: IPHLPAPI.DLL
	vma:  Hint/Ord Member-Name Bound-To
	6d7330	   63  GetAdaptersInfo

 006d6c98	006d72c8 00000000 00000000 006d7382 005dd4f0

	DLL Name: d3dx9_42.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d806a	   92  D3DXCreateTexture
	6d80a4	  147  D3DXGetImageInfoFromFileInMemory
	6d8034	   49  D3DXCreateEffectCompiler
	6d8020	   48  D3DXCreateEffect
	6d8008	   63  D3DXCreateEffectPool
	6d8050	   65  D3DXCreateFontIndirectA
	6d807e	   97  D3DXCreateTextureFromFileInMemoryEx
	6d80c8	  122  D3DXFileCreate
	6d80da	   88  D3DXCreateSprite
	6d80ee	  276  D3DXSaveSurfaceToFileA
	6d8108	  162  D3DXIntersectTri
	6d811c	  145  D3DXGetFVFVertexSize
	6d8134	  160  D3DXIntersect
	6d8144	  164  D3DXLoadMeshFromXInMemory
	6d7350	  300  D3DXVec2Normalize
	6d7364	  220  D3DXMatrixTransformation2D
	6d8176	  312  D3DXVec3ProjectArray
	6d818e	  319  D3DXVec3Unproject
	6d81a2	  178  D3DXLoadSurfaceFromFileInMemory
	6d81c4	   69  D3DXCreateLine
	6d81d6	  201  D3DXMatrixOrthoOffCenterLH
	6d8160	  167  D3DXLoadMeshFromXof

 006d6cac	006d6e0c 00000000 00000000 006d755a 005dd034

	DLL Name: KERNEL32.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d7420	   82  CloseHandle
	6d742e	  181  CreateThread
	6d743e	  659  GetTickCount
	6d744e	  935  QueryPerformanceCounter
	6d7468	  936  QueryPerformanceFrequency
	6d7484	 1202  Sleep
	6d748c	  211  DeleteFileA
	6d749a	  654  GetThreadPriority
	6d74ae	 1177  SetThreadPriority
	6d74c2	 1230  TryEnterCriticalSection
	6d74dc	  480  GetExitCodeThread
	6d74f0	 1297  WideCharToMultiByte
	6d7506	  871  MultiByteToWideChar
	6d751c	  840  LocalFree
	6d7528	  391  GetCommandLineW
	6d753a	  514  GetLastError
	6d754a	  155  CreateMutexA
	6d82f4	 1320  WritePrivateProfileSectionA
	6d82e0	  504  GetFullPathNameA
	6d82ce	  652  GetThreadLocale
	6d82b6	  619  GetSystemDefaultLCID
	6d82a0	  667  GetUserDefaultLCID
	6d740a	 1273  WaitForSingleObject
	6d73f2	  209  DeleteCriticalSection
	6d73da	  825  LeaveCriticalSection
	6d73c2	  238  EnterCriticalSection
	6d73a6	  738  InitializeCriticalSection
	6d7390	  905  OutputDebugStringA
	6d828c	  533  GetModuleHandleA
	6d851a	  633  GetSystemTimeAsFileTime
	6d84fe	  772  IsProcessorFeaturePresent
	6d84ea	  768  IsDebuggerPresent
	6d84ce	 1235  UnhandledExceptionFilter
	6d84ba	 1216  TerminateProcess
	6d84a8	  611  GetStartupInfoW
	6d8492	  723  HeapSetInformation
	6d8474	  745  InterlockedCompareExchange
	6d845e	  748  InterlockedExchange
	6d844e	  202  DecodePointer
	6d843e	  234  EncodePointer
	6d8420	 1189  SetUnhandledExceptionFilter
	6d840a	  531  GetModuleFileNameA
	6d83fa	  828  LoadLibraryA
	6d83e8	  581  GetProcAddress
	6d83da	  136  CreateFileA
	6d83c4	  453  GetCurrentThreadId
	6d83ae	  449  GetCurrentProcessId
	6d8394	 1271  WaitForMultipleObjects
	6d8386	  691  GlobalAlloc
	6d8378	  702  GlobalLock
	6d8368	  709  GlobalUnlock
	6d834c	  573  GetPrivateProfileSectionA
	6d8330	  577  GetPrivateProfileStringA
	6d8280	 1113  SetEvent
	6d8270	  130  CreateEventA
	6d8258	  704  GlobalMemoryStatusEx
	6d8246	  349  FormatMessageA
	6d822e	  446  GetCurrentDirectoryA
	6d8200	 1150  SetProcessAffinityMask
	6d821a	  448  GetCurrentProcess
	6d8312	 1322  WritePrivateProfileStringA

 006d6cc0	006d7144 00000000 00000000 006d75ba 005dd36c

	DLL Name: USER32.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d7576	  488  LoadCursorA
	6d75ac	  247  FindWindowA
	6d87a8	  612  ReleaseCapture
	6d879a	  640  SetCapture
	6d877c	  458  IsClipboardFormatAvailable
	6d7596	  659  SetForegroundWindow
	6d7568	  526  MessageBoxA
	6d7584	  714  SetWindowTextA
	6d8768	  278  GetClipboardData
	6d8758	  550  OpenClipboard
	6d8746	  213  EmptyClipboard
	6d8732	  646  SetClipboardData
	6d8720	   73  CloseClipboard
	6d8714	  648  SetCursor
	6d8700	  263  GetAsyncKeyState
	6d86ec	  382  GetSystemMetrics
	6d86d6	  301  GetForegroundWindow
	6d86c6	  166  DestroyWindow
	6d86be	  289  GetDC
	6d86b2	  492  LoadIconA
	6d869e	  588  RegisterClassExA
	6d868c	  109  CreateWindowExA
	6d867e	  735  ShowWindow
	6d866c	  155  DefWindowProcA
	6d865a	  707  SetWindowLongA
	6d864c	  539  MoveWindow
	6d863c	  710  SetWindowPos
	6d862a	  567  PostQuitMessage
	6d861a	  404  GetWindowInfo
	6d860a	  562  PeekMessageA
	6d85f6	  764  TranslateMessage
	6d85e2	  174  DispatchMessageA
	6d85d2	  288  GetCursorPos
	6d85c0	  621  ScreenToClient
	6d85ac	  538  MonitorFromWindow
	6d859c	  252  FlashWindowEx
	6d858c	  276  GetClientRect
	6d8578	  291  GetDesktopWindow
	6d8566	  350  GetMonitorInfoA
	6d8552	    2  AdjustWindowRect
	6d8544	   72  ClipCursor
	6d8534	  412  GetWindowRect

 006d6cd4	006d6dd8 00000000 00000000 006d761c 005dd000

	DLL Name: ADVAPI32.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d75c6	  560  RegCloseKey
	6d75f8	  621  RegQueryValueExA
	6d760c	  608  RegOpenKeyExA
	6d75d4	  637  RegSetValueExA
	6d75e6	  568  RegCreateKeyExA

 006d6ce8	006d7130 00000000 00000000 006d7640 005dd358

	DLL Name: SHELL32.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d762a	    6  CommandLineToArgvW

 006d6cfc	006d71f0 00000000 00000000 006d77d4 005dd418

	DLL Name: WINMM.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d764c	    8  PlaySoundA
	6d7740	  123  mmioGetInfo
	6d774e	  120  mmioCreateChunk
	6d7760	  121  mmioDescend
	6d776e	  131  mmioSeek
	6d77c8	  126  mmioOpenA
	6d77bc	  119  mmioClose
	6d77b0	  128  mmioRead
	6d77a4	  137  mmioWrite
	6d7796	  118  mmioAscend
	6d7788	  117  mmioAdvance
	6d777a	  134  mmioSetInfo

 006d6d10	006d728c 00000000 00000000 006d77de 005dd4b4

	DLL Name: binkw32.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d7672	   24  _BinkDoFrame@4
	6d7684	   15  _BinkClose@4
	6d7694	   39  _BinkNextFrame@4
	6d76a8	   64  _BinkWait@4
	6d76b6	   62  _BinkSetVolume@12
	6d76ca	   36  _BinkGoto@12
	6d76da	   31  _BinkGetSummary@8
	6d76ee	   40  _BinkOpen@8
	6d76fc	   25  _BinkGetError@0
	6d770e	   59  _BinkSetSoundSystem@8
	6d7726	   41  _BinkOpenDirectSound@4
	6d765a	   19  _BinkCopyToBuffer@28

 006d6d24	006d6f34 00000000 00000000 006d7c74 005dd15c

	DLL Name: MSVCR100.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d78b8	 1391  clock
	6d78c0	 1502  qsort
	6d78c8	 1505  rand
	6d78d0	 1522  srand
	6d78d8	 1040  _snprintf
	6d78e4	 1398  fclose
	6d78ee	 1539  strncmp
	6d78f8	 1409  fopen
	6d7900	 1427  ftell
	6d7908	 1425  fseek
	6d7910	 1417  fread
	6d7918	 1532  strcspn
	6d7922	 1451  isspace
	6d792c	 1430  fwrite
	6d7936	  460  _atoi64
	6d7940	 1445  isdigit
	6d794a	 1099  _strnicmp
	6d7956	 1093  _strlwr
	6d78ae	 1137  _time64
	6d796a	 1381  atof
	6d7972	  270  _CIacos
	6d797c	  274  _CIcos
	6d7986	  281  _CIsin
	6d7990	  283  _CIsqrt
	6d799a	   34  ??0exception@std@@QAE@ABQBD@Z
	6d79ba	  269  ?what@exception@std@@UBEPBDXZ
	6d79da	   93  ??1exception@std@@UAE@XZ
	6d79f6	  101  ??3@YAXPAX@Z
	6d7a06	  984  _purecall
	6d7a12	   99  ??2@YAPAXI@Z
	6d7a22	  289  _CxxThrowException
	6d7a38	   36  ??0exception@std@@QAE@ABV01@@Z
	6d7a5a	  314  __CxxFrameHandler3
	6d7a70	  277  _CIfmod
	6d7a7a	 1388  ceil
	6d7a82	  494  _controlfp
	6d7a90	 1394  div
	6d7a96	  271  _CIasin
	6d7aa0	  272  _CIatan
	6d7aaa	  273  _CIatan2
	6d7ab6	 1407  floor
	6d7abe	  284  _CItan
	6d7ac8	  322  __RTDynamicCast
	6d7ada	  122  ??_V@YAXPAX@Z
	6d7aea	  120  ??_U@YAPAXI@Z
	6d7afa	  276  _CIexp
	6d7b04	  278  _CIlog
	6d7b0e	 1485  memchr
	6d7b18	  280  _CIpow
	6d7b22	 1564  toupper
	6d7b2c	 1404  fgets
	6d7b34	 1068  _splitpath
	6d7b42	  695  _invalid_parameter_noinfo_noreturn
	6d7b68	 1442  isalnum
	6d7b72	 1508  remove
	6d7b7c	  786  _itoa
	6d7b84	 1509  rename
	6d7b8e	  960  _mkdir
	6d7b98	 1201  _vsnprintf
	6d7ba6	 1443  isalpha
	6d7bb0	  279  _CIlog10
	6d7bbc	 1240  _wcsicmp
	6d7bc8	 1401  fflush
	6d7bd2	  357  __iob_func
	6d7be0	 1495  printf
	6d7bea	 1450  ispunct
	6d7bf4	  569  _findclose
	6d7c02	  577  _findnext64i32
	6d7c14	  573  _findfirst64i32
	6d7c26	 1449  isprint
	6d7c30	  801  _localtime64
	6d7c40	 1079  _stat64i32
	6d7c4e	 1399  feof
	6d7c56	  928  _mbsrchr
	6d7c62	 1085  _strdup
	6d7c6c	 1413  fputc
	6d7c82	 1165  _unlock
	6d7c8c	  347  __dllonexit
	6d7c9a	  803  _lock
	6d7ca2	  969  _onexit
	6d7cac	  258  ?terminate@@YAXXZ
	6d7cc0	  453  _amsg_exit
	6d7cce	  355  __getmainargs
	6d7cde	  476  _cexit
	6d7ce8	  554  _exit
	6d7cf0	  301  _XcptFilter
	6d7cfe	  722  _ismbblead
	6d7d0c	  444  _acmdln
	6d7d16	  688  _initterm
	6d7d22	  689  _initterm_e
	6d7d30	  492  _configthreadlocale
	6d7d46	  418  __setusermatherr
	6d7d5a	  491  _commode
	6d7d66	  581  _fmode
	6d7d70	  415  __set_app_type
	6d7d82	  507  _crt_debugger_hook
	6d7d98	  238  ?_type_info_dtor_internal_method@type_info@@QAEXXZ
	6d7dce	  545  _except_handler4_common
	6d7de8	  696  _invoke_watson
	6d7dfa	  495  _controlfp_s
	6d789c	  446  _aligned_malloc
	6d7892	 1476  malloc
	6d788a	 1419  free
	6d7880	 1507  realloc
	6d7876	 1523  sscanf
	6d786c	 1411  fprintf
	6d7864	 1395  exit
	6d7858	 1575  vsprintf
	6d784e	 1489  memmove
	6d7844	 1519  sprintf
	6d783a	 1546  strstr
	6d7830	 1548  strtok
	6d7826	 1527  strchr
	6d781e	 1382  atoi
	6d7814	 1491  memset
	6d7808	 1089  _stricmp
	6d77fe	 1540  strncpy
	6d77f4	 1563  tolower
	6d77ea	 1487  memcpy
	6d881e	  542  _errno
	6d8828	 1387  calloc
	6d8832	 1400  ferror
	6d883c	  560  _fdopen
	6d8846	 1468  ldexp
	6d7960	 1537  strncat
	6d884e	 1422  frexp

 006d6d38	006d7224 00000000 00000000 006d7e0a 005dd44c

	DLL Name: WSOCK32.dll
	vma:  Hint/Ord Member-Name Bound-To
	8000000a	   10  <none>
	80000003	    3  <none>
	80000004	    4  <none>
	8000000e	   14  <none>
	80000073	  115  <none>
	80000074	  116  <none>
	80000006	    6  <none>
	80000002	    2  <none>
	8000000b	   11  <none>
	8000006f	  111  <none>
	80000008	    8  <none>
	8000000f	   15  <none>
	80000012	   18  <none>
	80000097	  151  <none>
	80000015	   21  <none>
	80000017	   23  <none>
	80000009	    9  <none>
	80000034	   52  <none>
	80000016	   22  <none>
	80000013	   19  <none>
	80000010	   16  <none>
	80000014	   20  <none>
	80000011	   17  <none>
	8000000c	   12  <none>
	80000039	   57  <none>

 006d6d4c	006d6f04 00000000 00000000 006d7fac 005dd12c

	DLL Name: MSVCP100.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d7e56	  593  ?_Orphan_all@_Container_base0@std@@QAEXXZ
	6d7f86	 1179  ?max@?$numeric_limits@M@std@@SAMXZ
	6d7f62	   90  ??0_Container_base12@std@@QAE@XZ
	6d7e82	  633  ?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
	6d7f34	  594  ?_Orphan_all@_Container_base12@std@@QAEXXZ
	6d7f10	  154  ??1_Container_base12@std@@QAE@XZ
	6d7ef6	   96  ??0_Lockit@std@@QAE@H@Z
	6d7edc	  158  ??1_Lockit@std@@QAE@XZ
	6d7eb2	  895  ?epsilon@?$numeric_limits@N@std@@SANXZ
	6d7e36	  652  ?_Xlength_error@std@@YAXPBD@Z
	6d7e16	  654  ?_Xout_of_range@std@@YAXPBD@Z

 006d6d60	006d7138 00000000 00000000 006d7fe0 005dd360

	DLL Name: SHLWAPI.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d7fba	   88  PathIsDirectoryA
	6d7fce	  120  PathMatchSpecA

 006d6d74	006d72c0 00000000 00000000 006d7ffe 005dd4e8

	DLL Name: d3d9.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d7fec	    9  Direct3DCreate9

 006d6d88	006d6df0 00000000 00000000 006d81f4 005dd018

	DLL Name: DSOUND.dll
	vma:  Hint/Ord Member-Name Bound-To
	80000001	    1  <none>

 006d6d9c	006d6df8 00000000 00000000 006d87e8 005dd020

	DLL Name: GDI32.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d87d0	  541  GetTextExtentPoint32A
	6d87ba	  650  SetDeviceGammaRamp

 006d6db0	006d7324 00000000 00000000 006d8814 005dd54c

	DLL Name: ole32.dll
	vma:  Hint/Ord Member-Name Bound-To
	6d87f2	  108  CoUninitialize
	6d8804	   62  CoInitialize

 006d6dc4	00000000 00000000 00000000 00000000 00000000



