dumps/sots.exe: file format pei-i386 Characteristics 0x102 executable 32 bit words Time/Date Sun Dec 17 19:11:57 2017 Magic 010b (PE32) MajorLinkerVersion 10 MinorLinkerVersion 0 SizeOfCode 005dba00 SizeOfInitializedData 001ac800 SizeOfUninitializedData 00000000 AddressOfEntryPoint 00525794 BaseOfCode 00001000 BaseOfData 005dd000 ImageBase 00400000 SectionAlignment 00001000 FileAlignment 00000200 MajorOSystemVersion 5 MinorOSystemVersion 1 MajorImageVersion 0 MinorImageVersion 0 MajorSubsystemVersion 5 MinorSubsystemVersion 1 Win32Version 00000000 SizeOfImage 007b3000 SizeOfHeaders 00000400 CheckSum 0079401b Subsystem 00000002 (Windows GUI) DllCharacteristics 00008140 DYNAMIC_BASE NX_COMPAT TERMINAL_SERVICE_AWARE SizeOfStackReserve 00100000 SizeOfStackCommit 00001000 SizeOfHeapReserve 00100000 SizeOfHeapCommit 00001000 LoaderFlags 00000000 NumberOfRvaAndSizes 00000010 The Data Directory Entry 0 00000000 00000000 Export Directory [.edata (or where ever we found it)] Entry 1 006d6c84 00000154 Import Directory [parts of .idata] Entry 2 00730000 00007924 Resource Directory [.rsrc] Entry 3 00000000 00000000 Exception Directory [.pdata] Entry 4 00000000 00000000 Security Directory Entry 5 00738000 0005ddc4 Base Relocation Directory [.reloc] Entry 6 005e0ff0 0000001c Debug Directory Entry 7 00000000 00000000 Description Directory Entry 8 00000000 00000000 Special Directory Entry 9 00000000 00000000 Thread Storage Directory [.tls] Entry a 00000000 00000000 Load Configuration Directory Entry b 00000000 00000000 Bound Import Directory Entry c 005dd000 00000558 Import Address Table Directory Entry d 00000000 00000000 Delay Import Directory Entry e 00000000 00000000 CLR Runtime Header Entry f 00000000 00000000 Reserved There is an import table in .rdata at 0xad6c84 The Import Tables (interpreted .rdata section contents) vma: Hint Time Forward DLL First Table Stamp Chain Name Thunk 006d6c84 006d6e04 00000000 00000000 006d7342 005dd02c DLL Name: IPHLPAPI.DLL vma: Hint/Ord Member-Name Bound-To 6d7330 63 GetAdaptersInfo 006d6c98 006d72c8 00000000 00000000 006d7382 005dd4f0 DLL Name: d3dx9_42.dll vma: Hint/Ord Member-Name Bound-To 6d806a 92 D3DXCreateTexture 6d80a4 147 D3DXGetImageInfoFromFileInMemory 6d8034 49 D3DXCreateEffectCompiler 6d8020 48 D3DXCreateEffect 6d8008 63 D3DXCreateEffectPool 6d8050 65 D3DXCreateFontIndirectA 6d807e 97 D3DXCreateTextureFromFileInMemoryEx 6d80c8 122 D3DXFileCreate 6d80da 88 D3DXCreateSprite 6d80ee 276 D3DXSaveSurfaceToFileA 6d8108 162 D3DXIntersectTri 6d811c 145 D3DXGetFVFVertexSize 6d8134 160 D3DXIntersect 6d8144 164 D3DXLoadMeshFromXInMemory 6d7350 300 D3DXVec2Normalize 6d7364 220 D3DXMatrixTransformation2D 6d8176 312 D3DXVec3ProjectArray 6d818e 319 D3DXVec3Unproject 6d81a2 178 D3DXLoadSurfaceFromFileInMemory 6d81c4 69 D3DXCreateLine 6d81d6 201 D3DXMatrixOrthoOffCenterLH 6d8160 167 D3DXLoadMeshFromXof 006d6cac 006d6e0c 00000000 00000000 006d755a 005dd034 DLL Name: KERNEL32.dll vma: Hint/Ord Member-Name Bound-To 6d7420 82 CloseHandle 6d742e 181 CreateThread 6d743e 659 GetTickCount 6d744e 935 QueryPerformanceCounter 6d7468 936 QueryPerformanceFrequency 6d7484 1202 Sleep 6d748c 211 DeleteFileA 6d749a 654 GetThreadPriority 6d74ae 1177 SetThreadPriority 6d74c2 1230 TryEnterCriticalSection 6d74dc 480 GetExitCodeThread 6d74f0 1297 WideCharToMultiByte 6d7506 871 MultiByteToWideChar 6d751c 840 LocalFree 6d7528 391 GetCommandLineW 6d753a 514 GetLastError 6d754a 155 CreateMutexA 6d82f4 1320 WritePrivateProfileSectionA 6d82e0 504 GetFullPathNameA 6d82ce 652 GetThreadLocale 6d82b6 619 GetSystemDefaultLCID 6d82a0 667 GetUserDefaultLCID 6d740a 1273 WaitForSingleObject 6d73f2 209 DeleteCriticalSection 6d73da 825 LeaveCriticalSection 6d73c2 238 EnterCriticalSection 6d73a6 738 InitializeCriticalSection 6d7390 905 OutputDebugStringA 6d828c 533 GetModuleHandleA 6d851a 633 GetSystemTimeAsFileTime 6d84fe 772 IsProcessorFeaturePresent 6d84ea 768 IsDebuggerPresent 6d84ce 1235 UnhandledExceptionFilter 6d84ba 1216 TerminateProcess 6d84a8 611 GetStartupInfoW 6d8492 723 HeapSetInformation 6d8474 745 InterlockedCompareExchange 6d845e 748 InterlockedExchange 6d844e 202 DecodePointer 6d843e 234 EncodePointer 6d8420 1189 SetUnhandledExceptionFilter 6d840a 531 GetModuleFileNameA 6d83fa 828 LoadLibraryA 6d83e8 581 GetProcAddress 6d83da 136 CreateFileA 6d83c4 453 GetCurrentThreadId 6d83ae 449 GetCurrentProcessId 6d8394 1271 WaitForMultipleObjects 6d8386 691 GlobalAlloc 6d8378 702 GlobalLock 6d8368 709 GlobalUnlock 6d834c 573 GetPrivateProfileSectionA 6d8330 577 GetPrivateProfileStringA 6d8280 1113 SetEvent 6d8270 130 CreateEventA 6d8258 704 GlobalMemoryStatusEx 6d8246 349 FormatMessageA 6d822e 446 GetCurrentDirectoryA 6d8200 1150 SetProcessAffinityMask 6d821a 448 GetCurrentProcess 6d8312 1322 WritePrivateProfileStringA 006d6cc0 006d7144 00000000 00000000 006d75ba 005dd36c DLL Name: USER32.dll vma: Hint/Ord Member-Name Bound-To 6d7576 488 LoadCursorA 6d75ac 247 FindWindowA 6d87a8 612 ReleaseCapture 6d879a 640 SetCapture 6d877c 458 IsClipboardFormatAvailable 6d7596 659 SetForegroundWindow 6d7568 526 MessageBoxA 6d7584 714 SetWindowTextA 6d8768 278 GetClipboardData 6d8758 550 OpenClipboard 6d8746 213 EmptyClipboard 6d8732 646 SetClipboardData 6d8720 73 CloseClipboard 6d8714 648 SetCursor 6d8700 263 GetAsyncKeyState 6d86ec 382 GetSystemMetrics 6d86d6 301 GetForegroundWindow 6d86c6 166 DestroyWindow 6d86be 289 GetDC 6d86b2 492 LoadIconA 6d869e 588 RegisterClassExA 6d868c 109 CreateWindowExA 6d867e 735 ShowWindow 6d866c 155 DefWindowProcA 6d865a 707 SetWindowLongA 6d864c 539 MoveWindow 6d863c 710 SetWindowPos 6d862a 567 PostQuitMessage 6d861a 404 GetWindowInfo 6d860a 562 PeekMessageA 6d85f6 764 TranslateMessage 6d85e2 174 DispatchMessageA 6d85d2 288 GetCursorPos 6d85c0 621 ScreenToClient 6d85ac 538 MonitorFromWindow 6d859c 252 FlashWindowEx 6d858c 276 GetClientRect 6d8578 291 GetDesktopWindow 6d8566 350 GetMonitorInfoA 6d8552 2 AdjustWindowRect 6d8544 72 ClipCursor 6d8534 412 GetWindowRect 006d6cd4 006d6dd8 00000000 00000000 006d761c 005dd000 DLL Name: ADVAPI32.dll vma: Hint/Ord Member-Name Bound-To 6d75c6 560 RegCloseKey 6d75f8 621 RegQueryValueExA 6d760c 608 RegOpenKeyExA 6d75d4 637 RegSetValueExA 6d75e6 568 RegCreateKeyExA 006d6ce8 006d7130 00000000 00000000 006d7640 005dd358 DLL Name: SHELL32.dll vma: Hint/Ord Member-Name Bound-To 6d762a 6 CommandLineToArgvW 006d6cfc 006d71f0 00000000 00000000 006d77d4 005dd418 DLL Name: WINMM.dll vma: Hint/Ord Member-Name Bound-To 6d764c 8 PlaySoundA 6d7740 123 mmioGetInfo 6d774e 120 mmioCreateChunk 6d7760 121 mmioDescend 6d776e 131 mmioSeek 6d77c8 126 mmioOpenA 6d77bc 119 mmioClose 6d77b0 128 mmioRead 6d77a4 137 mmioWrite 6d7796 118 mmioAscend 6d7788 117 mmioAdvance 6d777a 134 mmioSetInfo 006d6d10 006d728c 00000000 00000000 006d77de 005dd4b4 DLL Name: binkw32.dll vma: Hint/Ord Member-Name Bound-To 6d7672 24 _BinkDoFrame@4 6d7684 15 _BinkClose@4 6d7694 39 _BinkNextFrame@4 6d76a8 64 _BinkWait@4 6d76b6 62 _BinkSetVolume@12 6d76ca 36 _BinkGoto@12 6d76da 31 _BinkGetSummary@8 6d76ee 40 _BinkOpen@8 6d76fc 25 _BinkGetError@0 6d770e 59 _BinkSetSoundSystem@8 6d7726 41 _BinkOpenDirectSound@4 6d765a 19 _BinkCopyToBuffer@28 006d6d24 006d6f34 00000000 00000000 006d7c74 005dd15c DLL Name: MSVCR100.dll vma: Hint/Ord Member-Name Bound-To 6d78b8 1391 clock 6d78c0 1502 qsort 6d78c8 1505 rand 6d78d0 1522 srand 6d78d8 1040 _snprintf 6d78e4 1398 fclose 6d78ee 1539 strncmp 6d78f8 1409 fopen 6d7900 1427 ftell 6d7908 1425 fseek 6d7910 1417 fread 6d7918 1532 strcspn 6d7922 1451 isspace 6d792c 1430 fwrite 6d7936 460 _atoi64 6d7940 1445 isdigit 6d794a 1099 _strnicmp 6d7956 1093 _strlwr 6d78ae 1137 _time64 6d796a 1381 atof 6d7972 270 _CIacos 6d797c 274 _CIcos 6d7986 281 _CIsin 6d7990 283 _CIsqrt 6d799a 34 ??0exception@std@@QAE@ABQBD@Z 6d79ba 269 ?what@exception@std@@UBEPBDXZ 6d79da 93 ??1exception@std@@UAE@XZ 6d79f6 101 ??3@YAXPAX@Z 6d7a06 984 _purecall 6d7a12 99 ??2@YAPAXI@Z 6d7a22 289 _CxxThrowException 6d7a38 36 ??0exception@std@@QAE@ABV01@@Z 6d7a5a 314 __CxxFrameHandler3 6d7a70 277 _CIfmod 6d7a7a 1388 ceil 6d7a82 494 _controlfp 6d7a90 1394 div 6d7a96 271 _CIasin 6d7aa0 272 _CIatan 6d7aaa 273 _CIatan2 6d7ab6 1407 floor 6d7abe 284 _CItan 6d7ac8 322 __RTDynamicCast 6d7ada 122 ??_V@YAXPAX@Z 6d7aea 120 ??_U@YAPAXI@Z 6d7afa 276 _CIexp 6d7b04 278 _CIlog 6d7b0e 1485 memchr 6d7b18 280 _CIpow 6d7b22 1564 toupper 6d7b2c 1404 fgets 6d7b34 1068 _splitpath 6d7b42 695 _invalid_parameter_noinfo_noreturn 6d7b68 1442 isalnum 6d7b72 1508 remove 6d7b7c 786 _itoa 6d7b84 1509 rename 6d7b8e 960 _mkdir 6d7b98 1201 _vsnprintf 6d7ba6 1443 isalpha 6d7bb0 279 _CIlog10 6d7bbc 1240 _wcsicmp 6d7bc8 1401 fflush 6d7bd2 357 __iob_func 6d7be0 1495 printf 6d7bea 1450 ispunct 6d7bf4 569 _findclose 6d7c02 577 _findnext64i32 6d7c14 573 _findfirst64i32 6d7c26 1449 isprint 6d7c30 801 _localtime64 6d7c40 1079 _stat64i32 6d7c4e 1399 feof 6d7c56 928 _mbsrchr 6d7c62 1085 _strdup 6d7c6c 1413 fputc 6d7c82 1165 _unlock 6d7c8c 347 __dllonexit 6d7c9a 803 _lock 6d7ca2 969 _onexit 6d7cac 258 ?terminate@@YAXXZ 6d7cc0 453 _amsg_exit 6d7cce 355 __getmainargs 6d7cde 476 _cexit 6d7ce8 554 _exit 6d7cf0 301 _XcptFilter 6d7cfe 722 _ismbblead 6d7d0c 444 _acmdln 6d7d16 688 _initterm 6d7d22 689 _initterm_e 6d7d30 492 _configthreadlocale 6d7d46 418 __setusermatherr 6d7d5a 491 _commode 6d7d66 581 _fmode 6d7d70 415 __set_app_type 6d7d82 507 _crt_debugger_hook 6d7d98 238 ?_type_info_dtor_internal_method@type_info@@QAEXXZ 6d7dce 545 _except_handler4_common 6d7de8 696 _invoke_watson 6d7dfa 495 _controlfp_s 6d789c 446 _aligned_malloc 6d7892 1476 malloc 6d788a 1419 free 6d7880 1507 realloc 6d7876 1523 sscanf 6d786c 1411 fprintf 6d7864 1395 exit 6d7858 1575 vsprintf 6d784e 1489 memmove 6d7844 1519 sprintf 6d783a 1546 strstr 6d7830 1548 strtok 6d7826 1527 strchr 6d781e 1382 atoi 6d7814 1491 memset 6d7808 1089 _stricmp 6d77fe 1540 strncpy 6d77f4 1563 tolower 6d77ea 1487 memcpy 6d881e 542 _errno 6d8828 1387 calloc 6d8832 1400 ferror 6d883c 560 _fdopen 6d8846 1468 ldexp 6d7960 1537 strncat 6d884e 1422 frexp 006d6d38 006d7224 00000000 00000000 006d7e0a 005dd44c DLL Name: WSOCK32.dll vma: Hint/Ord Member-Name Bound-To 8000000a 10 80000003 3 80000004 4 8000000e 14 80000073 115 80000074 116 80000006 6 80000002 2 8000000b 11 8000006f 111 80000008 8 8000000f 15 80000012 18 80000097 151 80000015 21 80000017 23 80000009 9 80000034 52 80000016 22 80000013 19 80000010 16 80000014 20 80000011 17 8000000c 12 80000039 57 006d6d4c 006d6f04 00000000 00000000 006d7fac 005dd12c DLL Name: MSVCP100.dll vma: Hint/Ord Member-Name Bound-To 6d7e56 593 ?_Orphan_all@_Container_base0@std@@QAEXXZ 6d7f86 1179 ?max@?$numeric_limits@M@std@@SAMXZ 6d7f62 90 ??0_Container_base12@std@@QAE@XZ 6d7e82 633 ?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z 6d7f34 594 ?_Orphan_all@_Container_base12@std@@QAEXXZ 6d7f10 154 ??1_Container_base12@std@@QAE@XZ 6d7ef6 96 ??0_Lockit@std@@QAE@H@Z 6d7edc 158 ??1_Lockit@std@@QAE@XZ 6d7eb2 895 ?epsilon@?$numeric_limits@N@std@@SANXZ 6d7e36 652 ?_Xlength_error@std@@YAXPBD@Z 6d7e16 654 ?_Xout_of_range@std@@YAXPBD@Z 006d6d60 006d7138 00000000 00000000 006d7fe0 005dd360 DLL Name: SHLWAPI.dll vma: Hint/Ord Member-Name Bound-To 6d7fba 88 PathIsDirectoryA 6d7fce 120 PathMatchSpecA 006d6d74 006d72c0 00000000 00000000 006d7ffe 005dd4e8 DLL Name: d3d9.dll vma: Hint/Ord Member-Name Bound-To 6d7fec 9 Direct3DCreate9 006d6d88 006d6df0 00000000 00000000 006d81f4 005dd018 DLL Name: DSOUND.dll vma: Hint/Ord Member-Name Bound-To 80000001 1 006d6d9c 006d6df8 00000000 00000000 006d87e8 005dd020 DLL Name: GDI32.dll vma: Hint/Ord Member-Name Bound-To 6d87d0 541 GetTextExtentPoint32A 6d87ba 650 SetDeviceGammaRamp 006d6db0 006d7324 00000000 00000000 006d8814 005dd54c DLL Name: ole32.dll vma: Hint/Ord Member-Name Bound-To 6d87f2 108 CoUninitialize 6d8804 62 CoInitialize 006d6dc4 00000000 00000000 00000000 00000000 00000000