32b35919f174681bb2b80a582e5c19d0

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2010-Mar-09 03:35:57
Debug artifacts X:\trunk\Diablo2\Builder\PDB\D2Win.pdb

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 7.0
Microsoft Visual C++ 7.1
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C++ v7.1 EXE
Microsoft Visual C++ v7.1 DLL
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • LoadLibraryA
  • GetProcAddress
Memory manipulation functions often used by packers:
  • VirtualAlloc
  • VirtualProtect
Enumerates local disk drives:
  • GetDriveTypeA
  • GetVolumeInformationA
  • GetLogicalDriveStringsA
Reads the contents of the clipboard:
  • GetClipboardData
Safe VirusTotal score: 0/67 (Scanned on 2021-09-08 04:35:22) All the AVs think this file is safe.

Hashes

MD5 32b35919f174681bb2b80a582e5c19d0
SHA1 54b9bbdef0eeeca52d8af5bcb4c1ee6a36d1d171
SHA256 a9afb52d5116f77534f3e83eeb71e6d2d980a6b1c59be5dd38d503c2334730fb
SHA3 6b72836c222605ff8abb7198d257aaea8d98eee1e0a1aa043b59026b80d185dd
SSDeep 3072:q+ieXldDJHf5SqHbMDTQj6kr+HwpZ0bmJvluX0/:q+VlbRxwDTs5R
Imports Hash 139904b6646abde5d1d28c831aa2f57a

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x100

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 4
TimeDateStamp 2010-Mar-09 03:35:57
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED

Image Optional Header

Magic PE32
LinkerVersion 7.11
SizeOfCode 0x1a000
SizeOfInitializedData 0xb4000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000187E (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x1b000
ImageBase 0x6f8e0000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion 4.0
ImageVersion 1.B
SubsystemVersion 4.0
Win32VersionValue 0
SizeOfImage 0xcf000
SizeOfHeaders 0x1000
Checksum 0x2e9e8
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 880ea127cfab3f6602ef5e22d186bc72
SHA1 f407dabf899471ef46211bb6f3e7d4e354840d69
SHA256 aa87804f7fc8f6b6b5fcb816193697c8f337e1bddaf8ba7cb1cc34061ac90d0f
SHA3 1c5b15b79414d9c1368c72b0be2e9274c9b1aaf5b77549fe1e018777a8a65f37
VirtualSize 0x192a1
VirtualAddress 0x1000
SizeOfRawData 0x1a000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.61593

.rdata

MD5 dd40c773959cd818a402cea410a4ca8c
SHA1 aa3e4b6a570ef767964c706878b7046086012a27
SHA256 4989e6360fec69048cc50192fd07c0cd74cb962cff88239704d398adf40bc60c
SHA3 105a64aa8c3b73e92a4baf6255c234abab10d78ea0a9e2bec7ecae3d8d6340d9
VirtualSize 0x336e
VirtualAddress 0x1b000
SizeOfRawData 0x4000
PointerToRawData 0x1b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.63786

.data

MD5 68fd72f3614d658978decb04f6928101
SHA1 1ceaf329b2bc776a301c3178e39c9485ae9fb1fe
SHA256 05da13b8df512dcbad01c016078c52b46b5778baaf8e1ef149b860f74458aa89
SHA3 105b9341ffd3178cac856a77b29841e78873f4088fde2532a4cdaa613a355727
VirtualSize 0xacc58
VirtualAddress 0x1f000
SizeOfRawData 0x2000
PointerToRawData 0x1f000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.9548

.reloc

MD5 3d797ae340f0d004b7a8c074fe347f27
SHA1 449d5ecd8cc23339282c467c73579a2fd598e058
SHA256 ef38b84a8f4a82cc981deb1ed8aec37aa67079cc973f30a220b5224e6a85c2f8
SHA3 1dcfc6fe40c99b4e747e539eff4427fb669eb442fed9aff6daa5d46fe0d75adc
VirtualSize 0x26c0
VirtualAddress 0xcc000
SizeOfRawData 0x3000
PointerToRawData 0x21000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.3676

Imports

KERNEL32.dll LCMapStringA
VirtualQuery
InterlockedExchange
HeapSize
HeapReAlloc
RtlUnwind
InitializeCriticalSection
SetFilePointer
WriteFile
UnhandledExceptionFilter
VirtualFree
HeapCreate
GetTickCount
MultiByteToWideChar
LCMapStringW
GetCPInfo
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
VirtualAlloc
LoadLibraryA
SetStdHandle
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo
GetDriveTypeA
GetVolumeInformationA
GetLogicalDriveStringsA
CloseHandle
FlushFileBuffers
HeapDestroy
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapAlloc
HeapFree
TlsGetValue
TlsSetValue
TlsFree
GetLastError
SetLastError
TlsAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetVersionExA
GetCommandLineA
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetProcAddress
ExitProcess
GetFileAttributesA
DeleteFileA
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
Sleep
USER32.dll IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
OpenClipboard
SetClipboardData
GetKeyState
GetMessageA
GetWindowRect
PostQuitMessage
GetClientRect
PtInRect
GetMonitorInfoA
TranslateMessage
GetWindowPlacement
SetCursorPos
wsprintfA
DispatchMessageA
SetWindowPos
GetDesktopWindow
PeekMessageA
MonitorFromWindow
DefWindowProcA
CloseClipboard
SetRect
MessageBoxA
Storm.dll #501
#503
#515
#416
#417
#414
#514
#415
#513
#512
#403
#401
#412
#511
#252
#571
#276
#266
Fog.dll #10104
#10105
#10212
#10106
#10227
#10116
#10117
#10046
#10207
#10215
#10103
#10210
#10211
#10208
#10102
gdwBitMasks
#10045
#10209
#10265
#10029
#10039
#10109
#10043
#10024
#10107
#10042
gdwInvBitMasks
D2sound.dll #10045
#10070
#10004
#10011
#10030
#10024
#10035
#10013
D2CMP.dll #10104
#10068
#10019
#10060
#10086
#10000
#10002
#10069
#10049
#10005
#10006
#10070
#10065
#10021
D2Lang.dll ?unicode2Win@Unicode@@SIPADPADPBU1@H@Z
?strcat@Unicode@@SIPAU1@PAU1@PBU1@@Z
??_FUnicode@@QAEXXZ
#10003
?win2Unicode@Unicode@@SIPAU1@PAU1@PBDH@Z
?strcpy@Unicode@@SIPAU1@PAU1@PBU1@@Z
?strlen@Unicode@@SIHPBU1@@Z
?strnicmp@Unicode@@SIHPBU1@0I@Z
?strncmp@Unicode@@SIHPBU1@0I@Z
?toUnicode@Unicode@@SIPAU1@PAU1@PBDH@Z
?isLineBreak@Unicode@@SIHPBU1@I@Z
#10009
?isWhitespace@Unicode@@QBEHXZ
?sprintf@Unicode@@SAXHPAU1@PBU1@ZZ
?utf8ToUnicode@Unicode@@SIPAU1@PAU1@PBDH@Z
?strncpy@Unicode@@SIPAU1@PAU1@PBU1@H@Z
D2gfx.dll #10059
#10025
#10019
#10005
#10026
#10015
#10044
#10063
#10051
#10040
#10021
#10041
#10067
#10072
#10065
#10029
#10086
#10060
?rInitialWindowRect@@3UtagRECT@@A
#10043
#10085
#10080
#10031
#10045
#10048
#10017
#10014
#10074
#10032
#10078
#10024
#10000
#10052
#10035
#10079
#10061
#10022
#10011
ijl11.dll #2
#3
#5

Delayed Imports

Ordinal 10000
Address 0x93c0

(#2)

Ordinal 10001
Address 0x170b0

(#3)

Ordinal 10002
Address 0x114a0

(#4)

Ordinal 10003
Address 0xf860

(#5)

Ordinal 10004
Address 0x12de0

(#6)

Ordinal 10005
Address 0xa890

(#7)

Ordinal 10006
Address 0x17b30

(#8)

Ordinal 10007
Address 0xb480

(#9)

Ordinal 10008
Address 0x11760

(#10)

Ordinal 10009
Address 0xad30

(#11)

Ordinal 10010
Address 0x13930

(#12)

Ordinal 10011
Address 0x116a0

(#13)

Ordinal 10012
Address 0x16d70

(#14)

Ordinal 10013
Address 0x12e90

(#15)

Ordinal 10014
Address 0x18980

(#16)

Ordinal 10015
Address 0x80c0

(#17)

Ordinal 10016
Address 0xa4f0

(#18)

Ordinal 10017
Address 0x11190

(#19)

Ordinal 10018
Address 0xb450

(#20)

Ordinal 10019
Address 0x8740

(#21)

Ordinal 10020
Address 0x9730

(#22)

Ordinal 10021
Address 0x13720

(#23)

Ordinal 10022
Address 0x9740

(#24)

Ordinal 10023
Address 0xb370

(#25)

Ordinal 10024
Address 0x187e0

(#26)

Ordinal 10025
Address 0x113f0

(#27)

Ordinal 10026
Address 0x13110

(#28)

Ordinal 10027
Address 0x8290

(#29)

Ordinal 10028
Address 0x12b20

(#30)

Ordinal 10029
Address 0x110b0

(#31)

Ordinal 10030
Address 0x82d0

(#32)

Ordinal 10031
Address 0x170a0

(#33)

Ordinal 10032
Address 0x17c50

(#34)

Ordinal 10033
Address 0x8170

(#35)

Ordinal 10034
Address 0x17a80

(#36)

Ordinal 10035
Address 0x85f0

(#37)

Ordinal 10036
Address 0x8110

(#38)

Ordinal 10037
Address 0x88a0

(#39)

Ordinal 10038
Address 0x9ff0

(#40)

Ordinal 10039
Address 0x16770

(#41)

Ordinal 10040
Address 0x17090

(#42)

Ordinal 10041
Address 0x8b00

(#43)

Ordinal 10042
Address 0x14df0

(#44)

Ordinal 10043
Address 0xed40

(#45)

Ordinal 10044
Address 0x17060

(#46)

Ordinal 10045
Address 0xec70

(#47)

Ordinal 10046
Address 0x16720

(#48)

Ordinal 10047
Address 0x17ad0

(#49)

Ordinal 10048
Address 0x159e0

(#50)

Ordinal 10049
Address 0xf790

(#51)

Ordinal 10050
Address 0x18490

(#52)

Ordinal 10051
Address 0x12720

(#53)

Ordinal 10052
Address 0x17c90

(#54)

Ordinal 10053
Address 0x17a90

(#55)

Ordinal 10054
Address 0xc4a0

(#56)

Ordinal 10055
Address 0x12080

(#57)

Ordinal 10056
Address 0x10c40

(#58)

Ordinal 10057
Address 0x161b0

(#59)

Ordinal 10058
Address 0x10150

(#60)

Ordinal 10059
Address 0x12410

(#61)

Ordinal 10060
Address 0x11450

(#62)

Ordinal 10061
Address 0x8310

(#63)

Ordinal 10062
Address 0xedf0

(#64)

Ordinal 10063
Address 0xeba0

(#65)

Ordinal 10064
Address 0x15450

(#66)

Ordinal 10065
Address 0xf2d0

(#67)

Ordinal 10066
Address 0x12200

(#68)

Ordinal 10067
Address 0x8350

(#69)

Ordinal 10068
Address 0xfd70

(#70)

Ordinal 10069
Address 0x164a0

(#71)

Ordinal 10070
Address 0x12730

(#72)

Ordinal 10071
Address 0xf750

(#73)

Ordinal 10072
Address 0xb4b0

(#74)

Ordinal 10073
Address 0xa6d0

(#75)

Ordinal 10074
Address 0xabb0

(#76)

Ordinal 10075
Address 0xb240

(#77)

Ordinal 10076
Address 0x16dd0

(#78)

Ordinal 10077
Address 0xac50

(#79)

Ordinal 10078
Address 0x10c50

(#80)

Ordinal 10079
Address 0x8ab0

(#81)

Ordinal 10080
Address 0xc770

(#82)

Ordinal 10081
Address 0xabe0

(#83)

Ordinal 10082
Address 0xb650

(#84)

Ordinal 10083
Address 0x11e60

(#85)

Ordinal 10084
Address 0xa050

(#86)

Ordinal 10085
Address 0x118f0

(#87)

Ordinal 10086
Address 0xaa20

(#88)

Ordinal 10087
Address 0x8020

(#89)

Ordinal 10088
Address 0xa340

(#90)

Ordinal 10089
Address 0x8690

(#91)

Ordinal 10090
Address 0x11240

(#92)

Ordinal 10091
Address 0x10700

(#93)

Ordinal 10092
Address 0xed30

(#94)

Ordinal 10093
Address 0xc410

(#95)

Ordinal 10094
Address 0x8400

(#96)

Ordinal 10095
Address 0x8070

(#97)

Ordinal 10096
Address 0x12f60

(#98)

Ordinal 10097
Address 0xf830

(#99)

Ordinal 10098
Address 0x18560

(#100)

Ordinal 10099
Address 0x17b10

(#101)

Ordinal 10100
Address 0x18400

(#102)

Ordinal 10101
Address 0xb4c0

(#103)

Ordinal 10102
Address 0x178b0

(#104)

Ordinal 10103
Address 0x9200

(#105)

Ordinal 10104
Address 0x16580

(#106)

Ordinal 10105
Address 0x13770

(#107)

Ordinal 10106
Address 0x8450

(#108)

Ordinal 10107
Address 0x12ba0

(#109)

Ordinal 10108
Address 0x17920

(#110)

Ordinal 10109
Address 0x84f0

(#111)

Ordinal 10110
Address 0x133a0

(#112)

Ordinal 10111
Address 0xa7a0

(#113)

Ordinal 10112
Address 0x10030

(#114)

Ordinal 10113
Address 0xa690

(#115)

Ordinal 10114
Address 0x8230

(#116)

Ordinal 10115
Address 0x17b00

(#117)

Ordinal 10116
Address 0x11400

(#118)

Ordinal 10117
Address 0x8550

(#119)

Ordinal 10118
Address 0x10600

(#120)

Ordinal 10119
Address 0x10ed0

(#121)

Ordinal 10120
Address 0x8a30

(#122)

Ordinal 10121
Address 0xb420

(#123)

Ordinal 10122
Address 0xf6e0

(#124)

Ordinal 10123
Address 0xc7c0

(#125)

Ordinal 10124
Address 0x8640

(#126)

Ordinal 10125
Address 0x9290

(#127)

Ordinal 10126
Address 0xa6f0

(#128)

Ordinal 10127
Address 0x103d0

(#129)

Ordinal 10128
Address 0xf240

(#130)

Ordinal 10129
Address 0x11340

(#131)

Ordinal 10130
Address 0xa0a0

(#132)

Ordinal 10131
Address 0x178e0

(#133)

Ordinal 10132
Address 0xbb50

(#134)

Ordinal 10133
Address 0x7f40

(#135)

Ordinal 10134
Address 0x108a0

(#136)

Ordinal 10135
Address 0x8830

(#137)

Ordinal 10136
Address 0x13590

(#138)

Ordinal 10137
Address 0x9f30

(#139)

Ordinal 10138
Address 0x117a0

(#140)

Ordinal 10139
Address 0xa6b0

(#141)

Ordinal 10140
Address 0xb3e0

(#142)

Ordinal 10141
Address 0x17c00

(#143)

Ordinal 10142
Address 0x17d40

(#144)

Ordinal 10143
Address 0x17c70

(#145)

Ordinal 10144
Address 0x18060

(#146)

Ordinal 10145
Address 0x166f0

(#147)

Ordinal 10146
Address 0x13640

(#148)

Ordinal 10147
Address 0x17950

(#149)

Ordinal 10148
Address 0x17c40

(#150)

Ordinal 10149
Address 0x170e0

(#151)

Ordinal 10150
Address 0x12fa0

(#152)

Ordinal 10151
Address 0x10900

(#153)

Ordinal 10152
Address 0x135c0

(#154)

Ordinal 10153
Address 0xeda0

(#155)

Ordinal 10154
Address 0xe3c0

(#156)

Ordinal 10155
Address 0xf8a0

(#157)

Ordinal 10156
Address 0x17890

(#158)

Ordinal 10157
Address 0xb160

(#159)

Ordinal 10158
Address 0xa500

(#160)

Ordinal 10159
Address 0x11880

(#161)

Ordinal 10160
Address 0x86e0

(#162)

Ordinal 10161
Address 0x100b0

(#163)

Ordinal 10162
Address 0x11c30

(#164)

Ordinal 10163
Address 0xacf0

(#165)

Ordinal 10164
Address 0xee50

(#166)

Ordinal 10165
Address 0xa470

(#167)

Ordinal 10166
Address 0x136a0

(#168)

Ordinal 10167
Address 0x97c0

(#169)

Ordinal 10168
Address 0xe240

(#170)

Ordinal 10169
Address 0xa250

(#171)

Ordinal 10170
Address 0x13970

(#172)

Ordinal 10171
Address 0x120c0

(#173)

Ordinal 10172
Address 0xc720

(#174)

Ordinal 10173
Address 0xa820

(#175)

Ordinal 10174
Address 0x10070

(#176)

Ordinal 10175
Address 0x16cf0

(#177)

Ordinal 10176
Address 0x17b60

(#178)

Ordinal 10177
Address 0x12700

(#179)

Ordinal 10178
Address 0x8500

(#180)

Ordinal 10179
Address 0xb3a0

(#181)

Ordinal 10180
Address 0xa710

(#182)

Ordinal 10181
Address 0xf6b0

(#183)

Ordinal 10182
Address 0x10110

(#184)

Ordinal 10183
Address 0xbe80

(#185)

Ordinal 10184
Address 0x12fe0

(#186)

Ordinal 10185
Address 0x14e70

(#187)

Ordinal 10186
Address 0x8a50

(#188)

Ordinal 10187
Address 0x17eb0

(#189)

Ordinal 10188
Address 0xac80

(#190)

Ordinal 10189
Address 0xacb0

(#191)

Ordinal 10190
Address 0xed70

(#192)

Ordinal 10191
Address 0x16b90

(#193)

Ordinal 10192
Address 0xf7e0

(#194)

Ordinal 10193
Address 0xf5e0

(#195)

Ordinal 10194
Address 0xb340

(#196)

Ordinal 10195
Address 0x85a0

(#197)

Ordinal 10196
Address 0x17070

(#198)

Ordinal 10197
Address 0x9ee0

(#199)

Ordinal 10198
Address 0x115a0

(#200)

Ordinal 10199
Address 0x17af0

(#201)

Ordinal 10200
Address 0xbe00

(#202)

Ordinal 10201
Address 0x16470

(#203)

Ordinal 10202
Address 0x136e0

(#204)

Ordinal 10203
Address 0x17b50

(#205)

Ordinal 10204
Address 0x9c00

(#206)

Ordinal 10205
Address 0xbd00

(#207)

Ordinal 10206
Address 0x11010

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2010-Mar-09 03:35:57
Version 0.0
SizeofData 63
AddressOfRawData 0x1d200
PointerToRawData 0x1d200
Referenced File X:\trunk\Diablo2\Builder\PDB\D2Win.pdb

TLS Callbacks

Load Configuration

RICH Header

XOR Key 0x49cdfeb1
Unmarked objects 0
Linker (VS98 build 8168) 5
Imports (VS2003 (.NET) SP1 build 6030) 12
Imports (2067) 2
Imports (2179) 3
Total imports 236
C++ objects (VS2003 (.NET) SP1 build 6030) 2
ASM objects (VS2003 (.NET) SP1 build 6030) 22
C objects (VS2003 (.NET) SP1 build 6030) 99
100 (VS2003 (.NET) SP1 build 6030) 21
Exports (VS2003 (.NET) SP1 build 6030) 1
Linker (VS2003 (.NET) SP1 build 6030) 1

Errors

<-- -->