475 lines
13 KiB
Text
475 lines
13 KiB
Text
|
|
dumps/sots.exe: file format pei-i386
|
|
|
|
Characteristics 0x102
|
|
executable
|
|
32 bit words
|
|
|
|
Time/Date Sun Dec 17 19:11:57 2017
|
|
Magic 010b (PE32)
|
|
MajorLinkerVersion 10
|
|
MinorLinkerVersion 0
|
|
SizeOfCode 005dba00
|
|
SizeOfInitializedData 001ac800
|
|
SizeOfUninitializedData 00000000
|
|
AddressOfEntryPoint 00525794
|
|
BaseOfCode 00001000
|
|
BaseOfData 005dd000
|
|
ImageBase 00400000
|
|
SectionAlignment 00001000
|
|
FileAlignment 00000200
|
|
MajorOSystemVersion 5
|
|
MinorOSystemVersion 1
|
|
MajorImageVersion 0
|
|
MinorImageVersion 0
|
|
MajorSubsystemVersion 5
|
|
MinorSubsystemVersion 1
|
|
Win32Version 00000000
|
|
SizeOfImage 007b3000
|
|
SizeOfHeaders 00000400
|
|
CheckSum 0079401b
|
|
Subsystem 00000002 (Windows GUI)
|
|
DllCharacteristics 00008140
|
|
DYNAMIC_BASE
|
|
NX_COMPAT
|
|
TERMINAL_SERVICE_AWARE
|
|
SizeOfStackReserve 00100000
|
|
SizeOfStackCommit 00001000
|
|
SizeOfHeapReserve 00100000
|
|
SizeOfHeapCommit 00001000
|
|
LoaderFlags 00000000
|
|
NumberOfRvaAndSizes 00000010
|
|
|
|
The Data Directory
|
|
Entry 0 00000000 00000000 Export Directory [.edata (or where ever we found it)]
|
|
Entry 1 006d6c84 00000154 Import Directory [parts of .idata]
|
|
Entry 2 00730000 00007924 Resource Directory [.rsrc]
|
|
Entry 3 00000000 00000000 Exception Directory [.pdata]
|
|
Entry 4 00000000 00000000 Security Directory
|
|
Entry 5 00738000 0005ddc4 Base Relocation Directory [.reloc]
|
|
Entry 6 005e0ff0 0000001c Debug Directory
|
|
Entry 7 00000000 00000000 Description Directory
|
|
Entry 8 00000000 00000000 Special Directory
|
|
Entry 9 00000000 00000000 Thread Storage Directory [.tls]
|
|
Entry a 00000000 00000000 Load Configuration Directory
|
|
Entry b 00000000 00000000 Bound Import Directory
|
|
Entry c 005dd000 00000558 Import Address Table Directory
|
|
Entry d 00000000 00000000 Delay Import Directory
|
|
Entry e 00000000 00000000 CLR Runtime Header
|
|
Entry f 00000000 00000000 Reserved
|
|
|
|
There is an import table in .rdata at 0xad6c84
|
|
|
|
The Import Tables (interpreted .rdata section contents)
|
|
vma: Hint Time Forward DLL First
|
|
Table Stamp Chain Name Thunk
|
|
006d6c84 006d6e04 00000000 00000000 006d7342 005dd02c
|
|
|
|
DLL Name: IPHLPAPI.DLL
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d7330 63 GetAdaptersInfo
|
|
|
|
006d6c98 006d72c8 00000000 00000000 006d7382 005dd4f0
|
|
|
|
DLL Name: d3dx9_42.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d806a 92 D3DXCreateTexture
|
|
6d80a4 147 D3DXGetImageInfoFromFileInMemory
|
|
6d8034 49 D3DXCreateEffectCompiler
|
|
6d8020 48 D3DXCreateEffect
|
|
6d8008 63 D3DXCreateEffectPool
|
|
6d8050 65 D3DXCreateFontIndirectA
|
|
6d807e 97 D3DXCreateTextureFromFileInMemoryEx
|
|
6d80c8 122 D3DXFileCreate
|
|
6d80da 88 D3DXCreateSprite
|
|
6d80ee 276 D3DXSaveSurfaceToFileA
|
|
6d8108 162 D3DXIntersectTri
|
|
6d811c 145 D3DXGetFVFVertexSize
|
|
6d8134 160 D3DXIntersect
|
|
6d8144 164 D3DXLoadMeshFromXInMemory
|
|
6d7350 300 D3DXVec2Normalize
|
|
6d7364 220 D3DXMatrixTransformation2D
|
|
6d8176 312 D3DXVec3ProjectArray
|
|
6d818e 319 D3DXVec3Unproject
|
|
6d81a2 178 D3DXLoadSurfaceFromFileInMemory
|
|
6d81c4 69 D3DXCreateLine
|
|
6d81d6 201 D3DXMatrixOrthoOffCenterLH
|
|
6d8160 167 D3DXLoadMeshFromXof
|
|
|
|
006d6cac 006d6e0c 00000000 00000000 006d755a 005dd034
|
|
|
|
DLL Name: KERNEL32.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d7420 82 CloseHandle
|
|
6d742e 181 CreateThread
|
|
6d743e 659 GetTickCount
|
|
6d744e 935 QueryPerformanceCounter
|
|
6d7468 936 QueryPerformanceFrequency
|
|
6d7484 1202 Sleep
|
|
6d748c 211 DeleteFileA
|
|
6d749a 654 GetThreadPriority
|
|
6d74ae 1177 SetThreadPriority
|
|
6d74c2 1230 TryEnterCriticalSection
|
|
6d74dc 480 GetExitCodeThread
|
|
6d74f0 1297 WideCharToMultiByte
|
|
6d7506 871 MultiByteToWideChar
|
|
6d751c 840 LocalFree
|
|
6d7528 391 GetCommandLineW
|
|
6d753a 514 GetLastError
|
|
6d754a 155 CreateMutexA
|
|
6d82f4 1320 WritePrivateProfileSectionA
|
|
6d82e0 504 GetFullPathNameA
|
|
6d82ce 652 GetThreadLocale
|
|
6d82b6 619 GetSystemDefaultLCID
|
|
6d82a0 667 GetUserDefaultLCID
|
|
6d740a 1273 WaitForSingleObject
|
|
6d73f2 209 DeleteCriticalSection
|
|
6d73da 825 LeaveCriticalSection
|
|
6d73c2 238 EnterCriticalSection
|
|
6d73a6 738 InitializeCriticalSection
|
|
6d7390 905 OutputDebugStringA
|
|
6d828c 533 GetModuleHandleA
|
|
6d851a 633 GetSystemTimeAsFileTime
|
|
6d84fe 772 IsProcessorFeaturePresent
|
|
6d84ea 768 IsDebuggerPresent
|
|
6d84ce 1235 UnhandledExceptionFilter
|
|
6d84ba 1216 TerminateProcess
|
|
6d84a8 611 GetStartupInfoW
|
|
6d8492 723 HeapSetInformation
|
|
6d8474 745 InterlockedCompareExchange
|
|
6d845e 748 InterlockedExchange
|
|
6d844e 202 DecodePointer
|
|
6d843e 234 EncodePointer
|
|
6d8420 1189 SetUnhandledExceptionFilter
|
|
6d840a 531 GetModuleFileNameA
|
|
6d83fa 828 LoadLibraryA
|
|
6d83e8 581 GetProcAddress
|
|
6d83da 136 CreateFileA
|
|
6d83c4 453 GetCurrentThreadId
|
|
6d83ae 449 GetCurrentProcessId
|
|
6d8394 1271 WaitForMultipleObjects
|
|
6d8386 691 GlobalAlloc
|
|
6d8378 702 GlobalLock
|
|
6d8368 709 GlobalUnlock
|
|
6d834c 573 GetPrivateProfileSectionA
|
|
6d8330 577 GetPrivateProfileStringA
|
|
6d8280 1113 SetEvent
|
|
6d8270 130 CreateEventA
|
|
6d8258 704 GlobalMemoryStatusEx
|
|
6d8246 349 FormatMessageA
|
|
6d822e 446 GetCurrentDirectoryA
|
|
6d8200 1150 SetProcessAffinityMask
|
|
6d821a 448 GetCurrentProcess
|
|
6d8312 1322 WritePrivateProfileStringA
|
|
|
|
006d6cc0 006d7144 00000000 00000000 006d75ba 005dd36c
|
|
|
|
DLL Name: USER32.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d7576 488 LoadCursorA
|
|
6d75ac 247 FindWindowA
|
|
6d87a8 612 ReleaseCapture
|
|
6d879a 640 SetCapture
|
|
6d877c 458 IsClipboardFormatAvailable
|
|
6d7596 659 SetForegroundWindow
|
|
6d7568 526 MessageBoxA
|
|
6d7584 714 SetWindowTextA
|
|
6d8768 278 GetClipboardData
|
|
6d8758 550 OpenClipboard
|
|
6d8746 213 EmptyClipboard
|
|
6d8732 646 SetClipboardData
|
|
6d8720 73 CloseClipboard
|
|
6d8714 648 SetCursor
|
|
6d8700 263 GetAsyncKeyState
|
|
6d86ec 382 GetSystemMetrics
|
|
6d86d6 301 GetForegroundWindow
|
|
6d86c6 166 DestroyWindow
|
|
6d86be 289 GetDC
|
|
6d86b2 492 LoadIconA
|
|
6d869e 588 RegisterClassExA
|
|
6d868c 109 CreateWindowExA
|
|
6d867e 735 ShowWindow
|
|
6d866c 155 DefWindowProcA
|
|
6d865a 707 SetWindowLongA
|
|
6d864c 539 MoveWindow
|
|
6d863c 710 SetWindowPos
|
|
6d862a 567 PostQuitMessage
|
|
6d861a 404 GetWindowInfo
|
|
6d860a 562 PeekMessageA
|
|
6d85f6 764 TranslateMessage
|
|
6d85e2 174 DispatchMessageA
|
|
6d85d2 288 GetCursorPos
|
|
6d85c0 621 ScreenToClient
|
|
6d85ac 538 MonitorFromWindow
|
|
6d859c 252 FlashWindowEx
|
|
6d858c 276 GetClientRect
|
|
6d8578 291 GetDesktopWindow
|
|
6d8566 350 GetMonitorInfoA
|
|
6d8552 2 AdjustWindowRect
|
|
6d8544 72 ClipCursor
|
|
6d8534 412 GetWindowRect
|
|
|
|
006d6cd4 006d6dd8 00000000 00000000 006d761c 005dd000
|
|
|
|
DLL Name: ADVAPI32.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d75c6 560 RegCloseKey
|
|
6d75f8 621 RegQueryValueExA
|
|
6d760c 608 RegOpenKeyExA
|
|
6d75d4 637 RegSetValueExA
|
|
6d75e6 568 RegCreateKeyExA
|
|
|
|
006d6ce8 006d7130 00000000 00000000 006d7640 005dd358
|
|
|
|
DLL Name: SHELL32.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d762a 6 CommandLineToArgvW
|
|
|
|
006d6cfc 006d71f0 00000000 00000000 006d77d4 005dd418
|
|
|
|
DLL Name: WINMM.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d764c 8 PlaySoundA
|
|
6d7740 123 mmioGetInfo
|
|
6d774e 120 mmioCreateChunk
|
|
6d7760 121 mmioDescend
|
|
6d776e 131 mmioSeek
|
|
6d77c8 126 mmioOpenA
|
|
6d77bc 119 mmioClose
|
|
6d77b0 128 mmioRead
|
|
6d77a4 137 mmioWrite
|
|
6d7796 118 mmioAscend
|
|
6d7788 117 mmioAdvance
|
|
6d777a 134 mmioSetInfo
|
|
|
|
006d6d10 006d728c 00000000 00000000 006d77de 005dd4b4
|
|
|
|
DLL Name: binkw32.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d7672 24 _BinkDoFrame@4
|
|
6d7684 15 _BinkClose@4
|
|
6d7694 39 _BinkNextFrame@4
|
|
6d76a8 64 _BinkWait@4
|
|
6d76b6 62 _BinkSetVolume@12
|
|
6d76ca 36 _BinkGoto@12
|
|
6d76da 31 _BinkGetSummary@8
|
|
6d76ee 40 _BinkOpen@8
|
|
6d76fc 25 _BinkGetError@0
|
|
6d770e 59 _BinkSetSoundSystem@8
|
|
6d7726 41 _BinkOpenDirectSound@4
|
|
6d765a 19 _BinkCopyToBuffer@28
|
|
|
|
006d6d24 006d6f34 00000000 00000000 006d7c74 005dd15c
|
|
|
|
DLL Name: MSVCR100.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d78b8 1391 clock
|
|
6d78c0 1502 qsort
|
|
6d78c8 1505 rand
|
|
6d78d0 1522 srand
|
|
6d78d8 1040 _snprintf
|
|
6d78e4 1398 fclose
|
|
6d78ee 1539 strncmp
|
|
6d78f8 1409 fopen
|
|
6d7900 1427 ftell
|
|
6d7908 1425 fseek
|
|
6d7910 1417 fread
|
|
6d7918 1532 strcspn
|
|
6d7922 1451 isspace
|
|
6d792c 1430 fwrite
|
|
6d7936 460 _atoi64
|
|
6d7940 1445 isdigit
|
|
6d794a 1099 _strnicmp
|
|
6d7956 1093 _strlwr
|
|
6d78ae 1137 _time64
|
|
6d796a 1381 atof
|
|
6d7972 270 _CIacos
|
|
6d797c 274 _CIcos
|
|
6d7986 281 _CIsin
|
|
6d7990 283 _CIsqrt
|
|
6d799a 34 ??0exception@std@@QAE@ABQBD@Z
|
|
6d79ba 269 ?what@exception@std@@UBEPBDXZ
|
|
6d79da 93 ??1exception@std@@UAE@XZ
|
|
6d79f6 101 ??3@YAXPAX@Z
|
|
6d7a06 984 _purecall
|
|
6d7a12 99 ??2@YAPAXI@Z
|
|
6d7a22 289 _CxxThrowException
|
|
6d7a38 36 ??0exception@std@@QAE@ABV01@@Z
|
|
6d7a5a 314 __CxxFrameHandler3
|
|
6d7a70 277 _CIfmod
|
|
6d7a7a 1388 ceil
|
|
6d7a82 494 _controlfp
|
|
6d7a90 1394 div
|
|
6d7a96 271 _CIasin
|
|
6d7aa0 272 _CIatan
|
|
6d7aaa 273 _CIatan2
|
|
6d7ab6 1407 floor
|
|
6d7abe 284 _CItan
|
|
6d7ac8 322 __RTDynamicCast
|
|
6d7ada 122 ??_V@YAXPAX@Z
|
|
6d7aea 120 ??_U@YAPAXI@Z
|
|
6d7afa 276 _CIexp
|
|
6d7b04 278 _CIlog
|
|
6d7b0e 1485 memchr
|
|
6d7b18 280 _CIpow
|
|
6d7b22 1564 toupper
|
|
6d7b2c 1404 fgets
|
|
6d7b34 1068 _splitpath
|
|
6d7b42 695 _invalid_parameter_noinfo_noreturn
|
|
6d7b68 1442 isalnum
|
|
6d7b72 1508 remove
|
|
6d7b7c 786 _itoa
|
|
6d7b84 1509 rename
|
|
6d7b8e 960 _mkdir
|
|
6d7b98 1201 _vsnprintf
|
|
6d7ba6 1443 isalpha
|
|
6d7bb0 279 _CIlog10
|
|
6d7bbc 1240 _wcsicmp
|
|
6d7bc8 1401 fflush
|
|
6d7bd2 357 __iob_func
|
|
6d7be0 1495 printf
|
|
6d7bea 1450 ispunct
|
|
6d7bf4 569 _findclose
|
|
6d7c02 577 _findnext64i32
|
|
6d7c14 573 _findfirst64i32
|
|
6d7c26 1449 isprint
|
|
6d7c30 801 _localtime64
|
|
6d7c40 1079 _stat64i32
|
|
6d7c4e 1399 feof
|
|
6d7c56 928 _mbsrchr
|
|
6d7c62 1085 _strdup
|
|
6d7c6c 1413 fputc
|
|
6d7c82 1165 _unlock
|
|
6d7c8c 347 __dllonexit
|
|
6d7c9a 803 _lock
|
|
6d7ca2 969 _onexit
|
|
6d7cac 258 ?terminate@@YAXXZ
|
|
6d7cc0 453 _amsg_exit
|
|
6d7cce 355 __getmainargs
|
|
6d7cde 476 _cexit
|
|
6d7ce8 554 _exit
|
|
6d7cf0 301 _XcptFilter
|
|
6d7cfe 722 _ismbblead
|
|
6d7d0c 444 _acmdln
|
|
6d7d16 688 _initterm
|
|
6d7d22 689 _initterm_e
|
|
6d7d30 492 _configthreadlocale
|
|
6d7d46 418 __setusermatherr
|
|
6d7d5a 491 _commode
|
|
6d7d66 581 _fmode
|
|
6d7d70 415 __set_app_type
|
|
6d7d82 507 _crt_debugger_hook
|
|
6d7d98 238 ?_type_info_dtor_internal_method@type_info@@QAEXXZ
|
|
6d7dce 545 _except_handler4_common
|
|
6d7de8 696 _invoke_watson
|
|
6d7dfa 495 _controlfp_s
|
|
6d789c 446 _aligned_malloc
|
|
6d7892 1476 malloc
|
|
6d788a 1419 free
|
|
6d7880 1507 realloc
|
|
6d7876 1523 sscanf
|
|
6d786c 1411 fprintf
|
|
6d7864 1395 exit
|
|
6d7858 1575 vsprintf
|
|
6d784e 1489 memmove
|
|
6d7844 1519 sprintf
|
|
6d783a 1546 strstr
|
|
6d7830 1548 strtok
|
|
6d7826 1527 strchr
|
|
6d781e 1382 atoi
|
|
6d7814 1491 memset
|
|
6d7808 1089 _stricmp
|
|
6d77fe 1540 strncpy
|
|
6d77f4 1563 tolower
|
|
6d77ea 1487 memcpy
|
|
6d881e 542 _errno
|
|
6d8828 1387 calloc
|
|
6d8832 1400 ferror
|
|
6d883c 560 _fdopen
|
|
6d8846 1468 ldexp
|
|
6d7960 1537 strncat
|
|
6d884e 1422 frexp
|
|
|
|
006d6d38 006d7224 00000000 00000000 006d7e0a 005dd44c
|
|
|
|
DLL Name: WSOCK32.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
8000000a 10 <none>
|
|
80000003 3 <none>
|
|
80000004 4 <none>
|
|
8000000e 14 <none>
|
|
80000073 115 <none>
|
|
80000074 116 <none>
|
|
80000006 6 <none>
|
|
80000002 2 <none>
|
|
8000000b 11 <none>
|
|
8000006f 111 <none>
|
|
80000008 8 <none>
|
|
8000000f 15 <none>
|
|
80000012 18 <none>
|
|
80000097 151 <none>
|
|
80000015 21 <none>
|
|
80000017 23 <none>
|
|
80000009 9 <none>
|
|
80000034 52 <none>
|
|
80000016 22 <none>
|
|
80000013 19 <none>
|
|
80000010 16 <none>
|
|
80000014 20 <none>
|
|
80000011 17 <none>
|
|
8000000c 12 <none>
|
|
80000039 57 <none>
|
|
|
|
006d6d4c 006d6f04 00000000 00000000 006d7fac 005dd12c
|
|
|
|
DLL Name: MSVCP100.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d7e56 593 ?_Orphan_all@_Container_base0@std@@QAEXXZ
|
|
6d7f86 1179 ?max@?$numeric_limits@M@std@@SAMXZ
|
|
6d7f62 90 ??0_Container_base12@std@@QAE@XZ
|
|
6d7e82 633 ?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
|
|
6d7f34 594 ?_Orphan_all@_Container_base12@std@@QAEXXZ
|
|
6d7f10 154 ??1_Container_base12@std@@QAE@XZ
|
|
6d7ef6 96 ??0_Lockit@std@@QAE@H@Z
|
|
6d7edc 158 ??1_Lockit@std@@QAE@XZ
|
|
6d7eb2 895 ?epsilon@?$numeric_limits@N@std@@SANXZ
|
|
6d7e36 652 ?_Xlength_error@std@@YAXPBD@Z
|
|
6d7e16 654 ?_Xout_of_range@std@@YAXPBD@Z
|
|
|
|
006d6d60 006d7138 00000000 00000000 006d7fe0 005dd360
|
|
|
|
DLL Name: SHLWAPI.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d7fba 88 PathIsDirectoryA
|
|
6d7fce 120 PathMatchSpecA
|
|
|
|
006d6d74 006d72c0 00000000 00000000 006d7ffe 005dd4e8
|
|
|
|
DLL Name: d3d9.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d7fec 9 Direct3DCreate9
|
|
|
|
006d6d88 006d6df0 00000000 00000000 006d81f4 005dd018
|
|
|
|
DLL Name: DSOUND.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
80000001 1 <none>
|
|
|
|
006d6d9c 006d6df8 00000000 00000000 006d87e8 005dd020
|
|
|
|
DLL Name: GDI32.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d87d0 541 GetTextExtentPoint32A
|
|
6d87ba 650 SetDeviceGammaRamp
|
|
|
|
006d6db0 006d7324 00000000 00000000 006d8814 005dd54c
|
|
|
|
DLL Name: ole32.dll
|
|
vma: Hint/Ord Member-Name Bound-To
|
|
6d87f2 108 CoUninitialize
|
|
6d8804 62 CoInitialize
|
|
|
|
006d6dc4 00000000 00000000 00000000 00000000 00000000
|
|
|
|
|
|
|