rendered paste bodymingwm10.dll: file format pei-i386
Characteristics 0x2306
executable
line numbers stripped
32 bit words
debugging information removed
DLL
Time/Date Thu Dec 27 15:23:32 2007
Magic 010b (PE32)
MajorLinkerVersion 2
MinorLinkerVersion 56
SizeOfCode 00000a00
SizeOfInitializedData 00001600
SizeOfUninitializedData 00000200
AddressOfEntryPoint 00001060
BaseOfCode 00001000
BaseOfData 00002000
ImageBase 6fbc0000
SectionAlignment 00001000
FileAlignment 00000200
MajorOSystemVersion 4
MinorOSystemVersion 0
MajorImageVersion 1
MinorImageVersion 0
MajorSubsystemVersion 4
MinorSubsystemVersion 0
Win32Version 00000000
SizeOfImage 00008000
SizeOfHeaders 00000400
CheckSum 00004984
Subsystem 00000003 (Windows CUI)
DllCharacteristics 00000000
SizeOfStackReserve 00200000
SizeOfStackCommit 00001000
SizeOfHeapReserve 00100000
SizeOfHeapCommit 00001000
LoaderFlags 00000000
NumberOfRvaAndSizes 00000010
The Data Directory
Entry 0 00005000 000000f4 Export Directory [.edata (or where ever we found it)]
Entry 1 00006000 00000254 Import Directory [parts of .idata]
Entry 2 00000000 00000000 Resource Directory [.rsrc]
Entry 3 00000000 00000000 Exception Directory [.pdata]
Entry 4 00000000 00000000 Security Directory
Entry 5 00007000 000001c0 Base Relocation Directory [.reloc]
Entry 6 00000000 00000000 Debug Directory
Entry 7 00000000 00000000 Description Directory
Entry 8 00000000 00000000 Special Directory
Entry 9 00000000 00000000 Thread Storage Directory [.tls]
Entry a 00000000 00000000 Load Configuration Directory
Entry b 00000000 00000000 Bound Import Directory
Entry c 00000000 00000000 Import Address Table Directory
Entry d 00000000 00000000 Delay Import Directory
Entry e 00000000 00000000 CLR Runtime Header
Entry f 00000000 00000000 Reserved
There is an import table in .idata at 0x6fbc6000
The Import Tables (interpreted .idata section contents)
vma: Hint Time Forward DLL First
Table Stamp Chain Name Thunk
00006000 00006040 00000000 00000000 00006214 00006098
DLL Name: msvcrt.dll
vma: Hint/Ord Member-Name Bound-To
60ec 36 __dllonexit
60fa 111 _assert
6104 152 _errno
610e 533 abort
6116 545 calloc
6120 560 fflush
612a 575 free
6132 626 malloc
613c 634 memset
00006014 0000606c 00000000 00000000 00006244 000060c4
DLL Name: KERNEL32.dll
vma: Hint/Ord Member-Name Bound-To
6146 1 AddAtomA
6152 107 DeleteCriticalSection
616a 126 EnterCriticalSection
6182 176 FindAtomA
618e 221 GetAtomNameA
619e 325 GetLastError
61ae 492 InitializeCriticalSection
61ca 523 LeaveCriticalSection
61e2 765 TlsGetValue
00006028 00000000 00000000 00000000 00000000 00000000
There is an export table in .edata at 0x6fbc5000
The Export Tables (interpreted .edata section contents)
Export Flags 0
Time/Date stamp 4773b564
Major/Minor 0/0
Name 00005028 mingwm10.dll
Ordinal Base 1
Number in:
Export Address Table 00000002
[Name Pointer/Ordinal] Table 00000002
Table Addresses
Export Address Table 00005038
Name Pointer Table 00005040
Ordinal Table 00005048
Export Address Table -- Ordinal Base 1
[ 0] +base[ 1] 1280 Export RVA
[ 1] +base[ 2] 1200 Export RVA
[Ordinal/Name Pointer] Table
[ 1] __mingwthr_key_dtor
[ 0] __mingwthr_remove_key_dtor
PE File Base Relocations (interpreted .reloc section contents)
Virtual Address: 00001000 Chunk size 212 (0xd4) Number of fixups 102
reloc 0 offset 9 [1009] HIGHLOW
reloc 1 offset 13 [1013] HIGHLOW
reloc 2 offset 31 [1031] HIGHLOW
reloc 3 offset 4c [104c] HIGHLOW
reloc 4 offset a2 [10a2] HIGHLOW
reloc 5 offset c4 [10c4] HIGHLOW
reloc 6 offset d3 [10d3] HIGHLOW
reloc 7 offset 112 [1112] HIGHLOW
reloc 8 offset 120 [1120] HIGHLOW
reloc 9 offset 142 [1142] HIGHLOW
reloc 10 offset 150 [1150] HIGHLOW
reloc 11 offset 18b [118b] HIGHLOW
reloc 12 offset 196 [1196] HIGHLOW
reloc 13 offset 1ea [11ea] HIGHLOW
reloc 14 offset 23e [123e] HIGHLOW
reloc 15 offset 24a [124a] HIGHLOW
reloc 16 offset 253 [1253] HIGHLOW
reloc 17 offset 25a [125a] HIGHLOW
reloc 18 offset 28d [128d] HIGHLOW
reloc 19 offset 298 [1298] HIGHLOW
reloc 20 offset 2b3 [12b3] HIGHLOW
reloc 21 offset 2db [12db] HIGHLOW
reloc 22 offset 2f2 [12f2] HIGHLOW
reloc 23 offset 328 [1328] HIGHLOW
reloc 24 offset 343 [1343] HIGHLOW
reloc 25 offset 367 [1367] HIGHLOW
reloc 26 offset 374 [1374] HIGHLOW
reloc 27 offset 37f [137f] HIGHLOW
reloc 28 offset 398 [1398] HIGHLOW
reloc 29 offset 3b3 [13b3] HIGHLOW
reloc 30 offset 3bd [13bd] HIGHLOW
reloc 31 offset 3ce [13ce] HIGHLOW
reloc 32 offset 3d9 [13d9] HIGHLOW
reloc 33 offset 3f2 [13f2] HIGHLOW
reloc 34 offset 407 [1407] HIGHLOW
reloc 35 offset 412 [1412] HIGHLOW
reloc 36 offset 42a [142a] HIGHLOW
reloc 37 offset 430 [1430] HIGHLOW
reloc 38 offset 442 [1442] HIGHLOW
reloc 39 offset 471 [1471] HIGHLOW
reloc 40 offset 4aa [14aa] HIGHLOW
reloc 41 offset 4b4 [14b4] HIGHLOW
reloc 42 offset 4c8 [14c8] HIGHLOW
reloc 43 offset 4d2 [14d2] HIGHLOW
reloc 44 offset 4fe [14fe] HIGHLOW
reloc 45 offset 516 [1516] HIGHLOW
reloc 46 offset 52f [152f] HIGHLOW
reloc 47 offset 545 [1545] HIGHLOW
reloc 48 offset 55b [155b] HIGHLOW
reloc 49 offset 56a [156a] HIGHLOW
reloc 50 offset 572 [1572] HIGHLOW
reloc 51 offset 57a [157a] HIGHLOW
reloc 52 offset 582 [1582] HIGHLOW
reloc 53 offset 58c [158c] HIGHLOW
reloc 54 offset 599 [1599] HIGHLOW
reloc 55 offset 5db [15db] HIGHLOW
reloc 56 offset 5e7 [15e7] HIGHLOW
reloc 57 offset 5ec [15ec] HIGHLOW
reloc 58 offset 5f8 [15f8] HIGHLOW
reloc 59 offset 607 [1607] HIGHLOW
reloc 60 offset 610 [1610] HIGHLOW
reloc 61 offset 618 [1618] HIGHLOW
reloc 62 offset 62a [162a] HIGHLOW
reloc 63 offset 630 [1630] HIGHLOW
reloc 64 offset 638 [1638] HIGHLOW
reloc 65 offset 641 [1641] HIGHLOW
reloc 66 offset 649 [1649] HIGHLOW
reloc 67 offset 65c [165c] HIGHLOW
reloc 68 offset 661 [1661] HIGHLOW
reloc 69 offset 68a [168a] HIGHLOW
reloc 70 offset 695 [1695] HIGHLOW
reloc 71 offset 6a0 [16a0] HIGHLOW
reloc 72 offset 6ab [16ab] HIGHLOW
reloc 73 offset 6b6 [16b6] HIGHLOW
reloc 74 offset 6c1 [16c1] HIGHLOW
reloc 75 offset 6cc [16cc] HIGHLOW
reloc 76 offset 6d4 [16d4] HIGHLOW
reloc 77 offset 6de [16de] HIGHLOW
reloc 78 offset 6f1 [16f1] HIGHLOW
reloc 79 offset 712 [1712] HIGHLOW
reloc 80 offset 725 [1725] HIGHLOW
reloc 81 offset 72d [172d] HIGHLOW
reloc 82 offset 735 [1735] HIGHLOW
reloc 83 offset 762 [1762] HIGHLOW
reloc 84 offset 76a [176a] HIGHLOW
reloc 85 offset 772 [1772] HIGHLOW
reloc 86 offset 77a [177a] HIGHLOW
reloc 87 offset 782 [1782] HIGHLOW
reloc 88 offset 78a [178a] HIGHLOW
reloc 89 offset 792 [1792] HIGHLOW
reloc 90 offset 79a [179a] HIGHLOW
reloc 91 offset 7a2 [17a2] HIGHLOW
reloc 92 offset 7aa [17aa] HIGHLOW
reloc 93 offset 7b2 [17b2] HIGHLOW
reloc 94 offset 7ba [17ba] HIGHLOW
reloc 95 offset 7c2 [17c2] HIGHLOW
reloc 96 offset 7ca [17ca] HIGHLOW
reloc 97 offset 7d2 [17d2] HIGHLOW
reloc 98 offset 7da [17da] HIGHLOW
reloc 99 offset 7e2 [17e2] HIGHLOW
reloc 100 offset 7ea [17ea] HIGHLOW
reloc 101 offset 804 [1804] HIGHLOW
Virtual Address: 00002000 Chunk size 12 (0xc) Number of fixups 2
reloc 0 offset 0 [2000] HIGHLOW
reloc 1 offset 0 [2000] ABSOLUTE
Virtual Address: 00001000 Chunk size 212 (0xd4) Number of fixups 102
reloc 0 offset 9 [1009] HIGHLOW
reloc 1 offset 13 [1013] HIGHLOW
reloc 2 offset 31 [1031] HIGHLOW
reloc 3 offset 4c [104c] HIGHLOW
reloc 4 offset a2 [10a2] HIGHLOW
reloc 5 offset c4 [10c4] HIGHLOW
reloc 6 offset d3 [10d3] HIGHLOW
reloc 7 offset 112 [1112] HIGHLOW
reloc 8 offset 120 [1120] HIGHLOW
reloc 9 offset 142 [1142] HIGHLOW
reloc 10 offset 150 [1150] HIGHLOW
reloc 11 offset 18b [118b] HIGHLOW
reloc 12 offset 196 [1196] HIGHLOW
reloc 13 offset 1ea [11ea] HIGHLOW
reloc 14 offset 23e [123e] HIGHLOW
reloc 15 offset 24a [124a] HIGHLOW
reloc 16 offset 253 [1253] HIGHLOW
reloc 17 offset 25a [125a] HIGHLOW
reloc 18 offset 28d [128d] HIGHLOW
reloc 19 offset 298 [1298] HIGHLOW
reloc 20 offset 2b3 [12b3] HIGHLOW
reloc 21 offset 2db [12db] HIGHLOW
reloc 22 offset 2f2 [12f2] HIGHLOW
reloc 23 offset 328 [1328] HIGHLOW
reloc 24 offset 343 [1343] HIGHLOW
reloc 25 offset 367 [1367] HIGHLOW
reloc 26 offset 374 [1374] HIGHLOW
reloc 27 offset 37f [137f] HIGHLOW
reloc 28 offset 398 [1398] HIGHLOW
reloc 29 offset 3b3 [13b3] HIGHLOW
reloc 30 offset 3bd [13bd] HIGHLOW
reloc 31 offset 3ce [13ce] HIGHLOW
reloc 32 offset 3d9 [13d9] HIGHLOW
reloc 33 offset 3f2 [13f2] HIGHLOW
reloc 34 offset 407 [1407] HIGHLOW
reloc 35 offset 412 [1412] HIGHLOW
reloc 36 offset 42a [142a] HIGHLOW
reloc 37 offset 430 [1430] HIGHLOW
reloc 38 offset 442 [1442] HIGHLOW
reloc 39 offset 471 [1471] HIGHLOW
reloc 40 offset 4aa [14aa] HIGHLOW
reloc 41 offset 4b4 [14b4] HIGHLOW
reloc 42 offset 4c8 [14c8] HIGHLOW
reloc 43 offset 4d2 [14d2] HIGHLOW
reloc 44 offset 4fe [14fe] HIGHLOW
reloc 45 offset 516 [1516] HIGHLOW
reloc 46 offset 52f [152f] HIGHLOW
reloc 47 offset 545 [1545] HIGHLOW
reloc 48 offset 55b [155b] HIGHLOW
reloc 49 offset 56a [156a] HIGHLOW
reloc 50 offset 572 [1572] HIGHLOW
reloc 51 offset 57a [157a] HIGHLOW
reloc 52 offset 582 [1582] HIGHLOW
reloc 53 offset 58c [158c] HIGHLOW
reloc 54 offset 599 [1599] HIGHLOW
reloc 55 offset 5db [15db] HIGHLOW
reloc 56 offset 5e7 [15e7] HIGHLOW
reloc 57 offset 5ec [15ec] HIGHLOW
reloc 58 offset 5f8 [15f8] HIGHLOW
reloc 59 offset 607 [1607] HIGHLOW
reloc 60 offset 610 [1610] HIGHLOW
reloc 61 offset 618 [1618] HIGHLOW
reloc 62 offset 62a [162a] HIGHLOW
reloc 63 offset 630 [1630] HIGHLOW
reloc 64 offset 638 [1638] HIGHLOW
reloc 65 offset 641 [1641] HIGHLOW
reloc 66 offset 649 [1649] HIGHLOW
reloc 67 offset 65c [165c] HIGHLOW
reloc 68 offset 661 [1661] HIGHLOW
reloc 69 offset 68a [168a] HIGHLOW
reloc 70 offset 695 [1695] HIGHLOW
reloc 71 offset 6a0 [16a0] HIGHLOW
reloc 72 offset 6ab [16ab] HIGHLOW
reloc 73 offset 6b6 [16b6] HIGHLOW
reloc 74 offset 6c1 [16c1] HIGHLOW
reloc 75 offset 6cc [16cc] HIGHLOW
reloc 76 offset 6d4 [16d4] HIGHLOW
reloc 77 offset 6de [16de] HIGHLOW
reloc 78 offset 6f1 [16f1] HIGHLOW
reloc 79 offset 712 [1712] HIGHLOW
reloc 80 offset 725 [1725] HIGHLOW
reloc 81 offset 72d [172d] HIGHLOW
reloc 82 offset 735 [1735] HIGHLOW
reloc 83 offset 762 [1762] HIGHLOW
reloc 84 offset 76a [176a] HIGHLOW
reloc 85 offset 772 [1772] HIGHLOW
reloc 86 offset 77a [177a] HIGHLOW
reloc 87 offset 782 [1782] HIGHLOW
reloc 88 offset 78a [178a] HIGHLOW
reloc 89 offset 792 [1792] HIGHLOW
reloc 90 offset 79a [179a] HIGHLOW
reloc 91 offset 7a2 [17a2] HIGHLOW
reloc 92 offset 7aa [17aa] HIGHLOW
reloc 93 offset 7b2 [17b2] HIGHLOW
reloc 94 offset 7ba [17ba] HIGHLOW
reloc 95 offset 7c2 [17c2] HIGHLOW
reloc 96 offset 7ca [17ca] HIGHLOW
reloc 97 offset 7d2 [17d2] HIGHLOW
reloc 98 offset 7da [17da] HIGHLOW
reloc 99 offset 7e2 [17e2] HIGHLOW
reloc 100 offset 7ea [17ea] HIGHLOW
reloc 101 offset 804 [1804] HIGHLOW
Virtual Address: 00002000 Chunk size 12 (0xc) Number of fixups 2
reloc 0 offset 0 [2000] HIGHLOW
reloc 1 offset 0 [2000] ABSOLUTE