b40cfe9160e611ef442e4989bbfa84bb4dab495c450ecf69f4dc15b53af0e7ae

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2008-Mar-17 11:54:46
Detected languages English - United States
Debug artifacts dcomp.pdb
CompanyName Microsoft Corporation
FileDescription Microsoft DirectComposition Library
FileVersion 10.0.26100.9818 (WinBuild.160101.0800)
InternalName dcomp.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename dcomp.dll
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.26100.9818

Plugin Output

Suspicious The PE is possibly packed. Unusual section name found: fothk
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
 Functions which can be used for anti-debugging purposes:
  • NtQuerySystemInformation
  • NtQueryInformationProcess
 Can access the registry:
  • RegEnumValueW
  • RegOpenKeyExW
  • RegCloseKey
  • RegGetValueW
  • RegQueryValueExW
 Uses Windows's Native API:
  • NtDCompositionAddCrossDeviceVisualChild
  • NtDCompositionSetChannelConnectionId
  • NtDCompositionRemoveCrossDeviceVisualChild
  • NtDCompositionCreateAndBindSharedSection
  • NtDCompositionSynchronize
  • NtDCompositionGetFrameIdFromBatchId
  • NtDCompositionGetBatchId
  • NtDCompositionGetDeletedResources
  • NtDCompositionTelemetrySetApplicationId
  • NtDCompositionSetChannelCommitCompletionEvent
  • NtDCompositionWaitForChannel
  • NtDCompositionReleaseAllResources
  • NtDCompositionCommitChannel
  • NtDCompositionProcessChannelBatchBuffer
  • NtDCompositionNotifySuperWetInkWork
  • NtDCompositionGetFrameStatistics
  • NtDCompositionDestroyChannel
  • NtDCompositionCreateChannel
  • NtDCompositionSyncWait
  • NtFlipObjectCreate
  • NtFlipObjectDisconnectEndpoint
  • NtFlipObjectQueryEndpointConnected
  • NtFlipObjectQueryBufferAvailableEvent
  • NtTokenManagerCreateFlipObjectTokenHandle
  • NtFlipObjectPresentCancel
  • NtFlipObjectOpen
  • NtFlipObjectConsumerBeginProcessPresent
  • NtFlipObjectConsumerAcquirePresent
  • NtFlipObjectConsumerEndProcessPresent
  • NtFlipObjectConsumerAdjustUsageReference
  • NtTokenManagerCreateFlipObjectReturnTokenHandle
  • NtFlipObjectConsumerPostMessage
  • NtFlipObjectConsumerQueryBufferInfo
  • NtFlipObjectRemoveContent
  • NtFlipObjectSetContent
  • NtFlipObjectAddContent
  • NtGdiDdDDIGetSharedResourceAdapterLuidFlipManager
  • NtFlipObjectAddPoolBuffer
  • NtFlipObjectRemovePoolBuffer
  • NtFlipObjectQueryNextMessageToProducer
  • NtFlipObjectReadNextMessageToProducer
  • NtFlipObjectQueryLostEvent
  • NtFlipObjectEnablePresentStatisticsType
  • NtTokenManagerCreateCompositionTokenHandle
  • NtDCompositionEnableMMCSS
  • NtCreateCompositionInputSink
  • NtDCompositionCreateBufferCollection
  • NtDCompositionCreateSharedResourceHandle
  • NtCreateCompositionSurfaceHandle
  • NtDCompositionWaitForCompositorClock
  • NtDCompositionBoostCompositorClock
  • NtDCompositionGetTargetStatistics
  • NtDCompositionGetStatistics
  • NtDCompositionGetFrameId
  • NtVisualCaptureBits
  • NtQuerySystemInformation
  • NtUnmapViewOfSection
  • NtQueryInformationProcess
 Functions related to the privilege level:
  • OpenProcessToken
 Manipulates other processes:
  • OpenProcess
Info The PE is digitally signed. Signer: Microsoft Windows
Issuer: Microsoft Windows Production PCA 2026 RSA2048-SHA256
Safe VirusTotal score: 0/71 (Scanned on 2026-11-12 20:15:32) All the AVs think this file is safe.

Hashes

MD5 f8e4f58c664c8a24ec0a3d2a9ec083ed 🔍
SHA1 127e94a5e167c8394a7e5906b993369953240f15 🔍
SHA256 b40cfe9160e611ef442e4989bbfa84bb4dab495c450ecf69f4dc15b53af0e7ae 🔍
SHA3 f0e053e82893fe7d89d0ad04900c39b32bd3c227ab2917f28662b81d3b2db064 🔍
SSDeep 49152:fjnpjrIjxY8qOSMZeKkj53bFfmrgncRu1jLRoZDXvbAvKpj93HO9R:fKKySMgK4RmUwvjrk 🔍
Imports Hash 62e4c53604674fafc31296e149638474 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 8
TimeDateStamp 2008-Mar-17 11:54:46
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1a1000
SizeOfInitializedData 0x92000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000B8490 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x180000000
SectionAlignment 0x1000
FileAlignment 0x1000
OperatingSystemVersion A.0
ImageVersion A.0
SubsystemVersion A.0
Win32VersionValue 0
SizeOfImage 0x234000
SizeOfHeaders 0x1000
Checksum 0x2435e5
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
SizeofStackReserve 0x40000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 da6b6c21ada1d8f700218bfa219b1a73 🔍
SHA1 22f3028c5ff139aea44ce94a659dd351937cb19a 🔍
SHA256 ffcf3de38a396b7567246da2f10b8cc4d4cdc3c446a37c92550281e6936f3e51 🔍
SHA3 519b59df4e15199243ca4d25a00c915ac35f8e12f05e9b5200eef248c6d8ebb1 🔍
VirtualSize 0x19f0fe
VirtualAddress 0x1000
SizeOfRawData 0x1a0000
PointerToRawData 0x1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.26882

fothk

MD5 1c6af04c2fd3e0dee91d3441858dfc1f 🔍
SHA1 d82b57c19289546ca2cffe739840d659ecc91122 🔍
SHA256 487d43641cb73437730f767ff3d2ca056911966ab020a0af75d3648b855dbb7a 🔍
SHA3 52386e4b09cb18d6c8667c7abcf2deb13a71bc5518624758b3281e61dc3edbed 🔍
VirtualSize 0x1000
VirtualAddress 0x1a1000
SizeOfRawData 0x1000
PointerToRawData 0x1a1000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 0.0159202

.rdata

MD5 2f0cc4ee2c604aec8b668aa49f9b9d04 🔍
SHA1 ac2161bc58ed11409dca3a57b246d3b0654c56fe 🔍
SHA256 25928e32697bc859377610b6060ca7faf2eaa7411b2411e6af5e4b042d7a7063 🔍
SHA3 cebe6f0be80fece070206ffecdee57ddd54e5af5a5c598bacf6b765cfff8c58f 🔍
VirtualSize 0x59282
VirtualAddress 0x1a2000
SizeOfRawData 0x5a000
PointerToRawData 0x1a2000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.93509

.data

MD5 9376816d5e0b0f5cadae5764f37f52db 🔍
SHA1 43b5d38ac9baabc35b3fae1573da95a477c91cc8 🔍
SHA256 f070979b3f1e9cb9b259a8192804335c8fcdc82a96b351840bf91ac53d37c3d1 🔍
SHA3 7eaf612eeb54874c64a1a966a0ad86a9d0eba5ec5dfd5195f93c40e35b162de7 🔍
VirtualSize 0x9b00
VirtualAddress 0x1fc000
SizeOfRawData 0x5000
PointerToRawData 0x1fc000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 5.25445

.pdata

MD5 e31485a06f9d60f5cd648919ccddc91a 🔍
SHA1 202e972a6edfbbd9cef9daecde01d8d0cd751091 🔍
SHA256 0572acc445624d5717edc453881725fdb7e33acd4ebdbd21024186a78ef2bfdd 🔍
SHA3 a4d1c3bf64c194d389fe005ec630d9d846422254df510e509bc2038326fca793 🔍
VirtualSize 0x18750
VirtualAddress 0x206000
SizeOfRawData 0x19000
PointerToRawData 0x201000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.96621

.didat

MD5 8ef6fbaca3bd0f442c9a8741847a7ccc 🔍
SHA1 ea69788889ccc469df9cb8eb6c7bef9eb3dd795f 🔍
SHA256 4c5b449d989c227d9e9c89095b987d6674f5c2706f9521075afa16169e4029cf 🔍
SHA3 7258c71174e5438fa5972007d116701419e9fb9762a61ae39981c9ad7c00c900 🔍
VirtualSize 0x120
VirtualAddress 0x21f000
SizeOfRawData 0x1000
PointerToRawData 0x21a000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.300088

.rsrc

MD5 0d27fe7743220db1fd13a813963f1aa1 🔍
SHA1 87e6d10c87b5c52fbc7c8757d338adcc5322a0a5 🔍
SHA256 d695f349d9bcbe241f0ac51d87ec42836ae0716235a0b87e99a4f2349d9662d6 🔍
SHA3 62fdb72b33db75de0f563c15a182a0e60a985368182f2227126f4eb91e947246 🔍
VirtualSize 0x9278
VirtualAddress 0x220000
SizeOfRawData 0xa000
PointerToRawData 0x21b000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.59904

.reloc

MD5 7ee1abaa8af2eb9fcc11bdf4b1a0f504 🔍
SHA1 74b0dfc0bd3d6c598afa0e4e62bf9de99513ee74 🔍
SHA256 ce44f3680bb32fb4d3d762a2946d79f5a65dd59721891f2c2fc009f55320c986 🔍
SHA3 315bd9a2bc77d6c7182b303dde33707c1e497702c3071aa6daffd3e54d850f55 🔍
VirtualSize 0x9c3c
VirtualAddress 0x22a000
SizeOfRawData 0xa000
PointerToRawData 0x225000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.42647

Imports

win32u.dll NtDCompositionAddCrossDeviceVisualChild
NtDCompositionSetChannelConnectionId
NtDCompositionRemoveCrossDeviceVisualChild
NtDCompositionCreateAndBindSharedSection
NtDCompositionSynchronize
NtDCompositionGetFrameIdFromBatchId
NtDCompositionGetBatchId
NtDCompositionGetDeletedResources
NtDCompositionTelemetrySetApplicationId
NtDCompositionSetChannelCommitCompletionEvent
NtDCompositionWaitForChannel
NtDCompositionReleaseAllResources
NtDCompositionCommitChannel
NtDCompositionProcessChannelBatchBuffer
NtDCompositionNotifySuperWetInkWork
NtDCompositionGetFrameStatistics
NtDCompositionDestroyChannel
NtDCompositionCreateChannel
NtDCompositionSyncWait
NtFlipObjectCreate
NtFlipObjectDisconnectEndpoint
NtFlipObjectQueryEndpointConnected
NtFlipObjectQueryBufferAvailableEvent
NtTokenManagerCreateFlipObjectTokenHandle
NtFlipObjectPresentCancel
NtFlipObjectOpen
NtFlipObjectConsumerBeginProcessPresent
NtFlipObjectConsumerAcquirePresent
NtFlipObjectConsumerEndProcessPresent
NtFlipObjectConsumerAdjustUsageReference
NtTokenManagerCreateFlipObjectReturnTokenHandle
NtFlipObjectConsumerPostMessage
NtFlipObjectConsumerQueryBufferInfo
NtFlipObjectRemoveContent
NtFlipObjectSetContent
NtFlipObjectAddContent
NtGdiDdDDIGetSharedResourceAdapterLuidFlipManager
NtFlipObjectAddPoolBuffer
NtFlipObjectRemovePoolBuffer
NtFlipObjectQueryNextMessageToProducer
NtFlipObjectReadNextMessageToProducer
NtFlipObjectQueryLostEvent
NtFlipObjectEnablePresentStatisticsType
NtTokenManagerCreateCompositionTokenHandle
NtDCompositionEnableMMCSS
NtCreateCompositionInputSink
NtDCompositionCreateBufferCollection
NtDCompositionCreateSharedResourceHandle
NtCreateCompositionSurfaceHandle
NtDCompositionWaitForCompositorClock
NtDCompositionBoostCompositorClock
NtDCompositionGetTargetStatistics
NtDCompositionGetStatistics
NtDCompositionGetFrameId
NtVisualCaptureBits
msvcp_win.dll ??0_Lockit@std@@QEAA@H@Z
??0_Locinfo@std@@QEAA@PEBD@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??1_Lockit@std@@QEAA@XZ
??1_Locinfo@std@@QEAA@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
??1facet@locale@std@@MEAA@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xlength_error@std@@YAXPEBD@Z
??0facet@locale@std@@IEAA@_K@Z
?id@?$collate@G@std@@2V0locale@2@A
?tolower@?$ctype@G@std@@QEBAGG@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
_Wcscoll
_Wcsxfrm
api-ms-win-crt-runtime-l1-1-0.dll _initterm
_initterm_e
_invoke_watson
api-ms-win-crt-math-l1-1-0.dll _finite
api-ms-win-crt-string-l1-1-0.dll wcsnlen
wcsncmp
memset
api-ms-win-crt-private-l1-1-0.dll _o__errno
_o__execute_onexit_table
_o__fdclass
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o__wcsicmp
_o__wcsicmp_l
_o__wtof
_o_abort
_o_ceilf
_o_free
_o_malloc
_o_qsort
_o_realloc
_o_sin
_o_sqrt
_o_strncat_s
_o_towlower
_o_wcscpy_s
_o_wcsncpy_s
strchr
__CxxFrameHandler4
__std_terminate
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__crt_atexit
_o__configure_narrow_argv
__C_specific_handler
_o__cexit
_CxxThrowException
memcmp
memcpy
api-ms-win-core-libraryloader-l1-2-0.dll GetModuleFileNameA
GetModuleHandleExA
FreeLibraryAndExitThread
FreeLibrary
GetModuleFileNameW
GetProcAddress
GetModuleHandleW
GetModuleHandleExW
api-ms-win-core-synch-l1-1-0.dll CreateEventExW
OpenSemaphoreW
WaitForSingleObjectEx
ResetEvent
InitializeSRWLock
InitializeCriticalSection
ReleaseSRWLockExclusive
ReleaseMutex
ReleaseSRWLockShared
CreateEventW
ReleaseSemaphore
AcquireSRWLockExclusive
EnterCriticalSection
CreateSemaphoreExW
SetEvent
WaitForSingleObject
LeaveCriticalSection
DeleteCriticalSection
AcquireSRWLockShared
CreateMutexExW
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
SetWaitableTimer
api-ms-win-core-heap-l1-1-0.dll HeapReAlloc
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-core-errorhandling-l1-1-0.dll RaiseException
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-threadpool-l1-2-0.dll CloseThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolTimer
WaitForThreadpoolWorkCallbacks
WaitForThreadpoolTimerCallbacks
CreateThreadpoolWork
SetThreadpoolTimer
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
SetThreadpoolWait
CreateThreadpoolTimer
CreateThreadpoolWait
api-ms-win-core-processthreads-l1-1-0.dll CreateThread
GetThreadId
SetThreadPriority
GetCurrentProcessId
ResumeThread
GetCurrentProcess
TerminateProcess
OpenProcessToken
GetCurrentThreadId
api-ms-win-core-localization-l1-2-0.dll FormatMessageW
api-ms-win-core-debug-l1-1-0.dll IsDebuggerPresent
OutputDebugStringW
DebugBreak
api-ms-win-core-handle-l1-1-0.dll CloseHandle
DuplicateHandle
api-ms-win-eventing-provider-l1-1-0.dll EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer
api-ms-win-core-winrt-string-l1-1-0.dll WindowsCreateString
WindowsDuplicateString
WindowsTrimStringStart
WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsTrimStringEnd
WindowsGetStringLen
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsConcatString
WindowsCreateStringReference
WindowsSubstringWithSpecifiedLength
WindowsCompareStringOrdinal
api-ms-win-core-winrt-l1-1-0.dll RoGetActivationFactory
api-ms-win-core-sysinfo-l1-1-0.dll GetTickCount64
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-memory-l1-1-0.dll CreateFileMappingW
VirtualFree
MapViewOfFile
VirtualAlloc
api-ms-win-core-synch-l1-2-0.dll InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
Sleep
api-ms-win-core-profile-l1-1-0.dll QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-com-l1-1-0.dll CoCreateFreeThreadedMarshaler
CoCreateInstance
CoMarshalInterface
CoGetApartmentType
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
CoGetInterfaceAndReleaseStream
CoReleaseMarshalData
PropVariantClear
api-ms-win-core-errorhandling-l1-1-3.dll TerminateProcessOnMemoryExhaustion
api-ms-win-core-sysinfo-l1-2-0.dll GetNativeSystemInfo
api-ms-win-core-libraryloader-l1-2-1.dll LoadLibraryW
api-ms-win-core-rtlsupport-l1-1-0.dll RtlCaptureStackBackTrace
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-2.dll RaiseFailFastException
api-ms-win-core-registry-l1-1-0.dll RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegGetValueW
RegQueryValueExW
api-ms-win-core-winrt-error-l1-1-0.dll SetRestrictedErrorInfo
RoFailFastWithErrorContext
GetRestrictedErrorInfo
RoTransformError
RoOriginateError
RoOriginateErrorW
api-ms-win-core-util-l1-1-0.dll DecodePointer
EncodePointer
api-ms-win-core-com-l1-1-1.dll RoGetAgileReference
api-ms-win-core-winrt-error-l1-1-1.dll IsErrorPropagationEnabled
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
api-ms-win-security-base-l1-1-0.dll GetTokenInformation
AllocateLocallyUniqueId
api-ms-win-core-processthreads-l1-1-1.dll OpenProcess
IsProcessorFeaturePresent
api-ms-win-core-string-l1-1-0.dll CompareStringOrdinal
WideCharToMultiByte
api-ms-win-core-psapi-l1-1-0.dll K32GetModuleFileNameExW
QueryFullProcessImageNameW
api-ms-win-core-synch-l1-2-1.dll CreateWaitableTimerW
ntdll.dll NtQuerySystemInformation
RtlGetDeviceFamilyInfoEnum
RtlQueryPackageClaims
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
RtlInitializeGenericTable
RtlGetLastNtStatus
RtlEnumerateGenericTableWithoutSplaying
RtlInsertElementGenericTable
RtlLookupElementGenericTable
RtlGetElementGenericTable
RtlNumberGenericTableElements
RtlAllocateHeap
RtlCreateHeap
RtlDestroyHeap
NtUnmapViewOfSection
NtQueryInformationProcess
RtlDeleteElementGenericTable
RtlFreeHeap
api-ms-win-appmodel-unlock-l1-1-0.dll IsDeveloperModeEnabled
api-ms-win-rtcore-ntuser-private-l1-1-0.dll DestroyDCompositionHwndTarget
CreateDCompositionHwndTarget
api-ms-win-rtcore-ntuser-private-l1-1-7.dll IsOneCoreTransformMode
api-ms-win-rtcore-ntuser-private-l1-1-9.dll #2657
api-ms-win-rtcore-ntuser-private-l1-1-11.dll GetDCompositionHwndBitmap
Microsoft.Internal.WarpPal.dll WarpPalCreateExtensionFactory
WarpPalGetDeviceCaps
api-ms-win-stateseparation-helpers-l1-1-0.dll GetPersistedRegistryValueW
api-ms-win-core-apiquery-l1-1-0.dll ApiSetQueryApiSetPresence
api-ms-win-core-version-l1-1-1.dll GetFileVersionInfoSizeW
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0.dll VerQueryValueW
api-ms-win-core-delayload-l1-1-1.dll ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0.dll DelayLoadFailureHook
api-ms-win-core-interlocked-l1-1-0.dll InitializeSListHead
CoreMessaging.dll (delay-loaded) CoreUICreate
CoreUICallCreateConversationHost
CoreUICallReceive
CoreUICallCreateEndpointHost
CoreUICallSend
CoreUICreateEx
GetDispatcherQueueForCurrentThread

Delayed Imports

Attributes 0x1
Name CoreMessaging.dll
ModuleHandle 0x201570
DelayImportAddressTable 0x21f000
DelayImportNameTable 0x1f5cf8
BoundDelayImportTable 0x1f6020
UnloadDelayImportTable 0
TimeStamp 1970-Jan-01 00:00:00

DCompositionAttachMouseDragToHwnd

Ordinal 1017
Address 0x116b40

DCompositionAttachMouseWheelToHwnd

Ordinal 1018
Address 0x116bc0

Ordinal 1019
Address 0x1f7c67
ForwardName win32u.NtCreateCompositionInputSink

DCompositionCreateDevice

Ordinal 1020
Address 0xf9c80

DCompositionCreateDevice2

Ordinal 1021
Address 0xee620

DCompositionCreateDevice3

Ordinal 1022
Address 0xea080

DCompositionCreateSurfaceHandle

Ordinal 1023
Address 0xc7390

DllCanUnloadNow

Ordinal 1024
Address 0xbefb0

DllGetActivationFactory

Ordinal 1025
Address 0xbeff0

DllGetClassObject

Ordinal 1026
Address 0x120bf0

DwmEnableMMCSS

Ordinal 1027
Address 0x116b10

(#2)

Ordinal 1028
Address 0x1f7d10
ForwardName win32u.NtDesktopCaptureBits

DwmFlush

Ordinal 1029
Address 0xc2c90

DwmpEnableDDASupport

Ordinal 1030
Address 0xc2c90

(#3)

Ordinal 1031
Address 0x9ce60

(#4)

Ordinal 1038
Address 0xe9480

(#5)

Ordinal 1039
Address 0xedc70

DCompositionCreateSharedVisualHandle

Ordinal 1040
Address 0xca750

(#6)

Ordinal 1041
Address 0xd1c20

(#7)

Ordinal 1042
Address 0x11a6a0

(#8)

Ordinal 1043
Address 0x1f7c45
ForwardName win32u.NtCompositionSetDropTarget

(#9)

Ordinal 1044
Address 0x1f7c8b
ForwardName win32u.NtCreateImplicitCompositionInputSink

(#10)

Ordinal 1045
Address 0x1f7cb7
ForwardName win32u.NtDCompositionCommitSynchronizationObject

(#11)

Ordinal 1046
Address 0x1f7ce8
ForwardName win32u.NtDCompositionGetFrameStatistics

(#12)

Ordinal 1060
Address 0xd6920

DCompositionGetFrameId

Ordinal 1100
Address 0xd7d90

DCompositionGetStatistics

Ordinal 1101
Address 0xc2c50

DCompositionGetTargetStatistics

Ordinal 1102
Address 0xc3d90

DCompositionBoostCompositorClock

Ordinal 1103
Address 0xe58b0

DCompositionWaitForCompositorClock

Ordinal 1104
Address 0xcc3e0

(#13)

Ordinal 2000
Address 0x64ec0

(#14)

Ordinal 2001
Address 0xb4e30

(#15)

Ordinal 2002
Address 0x62210

CreatePresentationFactory

Ordinal 2005
Address 0x1957a0

(#16)

Ordinal 2006
Address 0x1188f0

(#17)

Ordinal 2007
Address 0x116cb0

(#18)

Ordinal 2500
Address 0x1949b0

(#19)

Ordinal 2501
Address 0x4a80

(#20)

Ordinal 2502
Address 0xc6c10

(#21)

Ordinal 2503
Address 0xd2990

(#22)

Ordinal 2504
Address 0x194050

(#23)

Ordinal 2505
Address 0x116c40

1

Type WEVT_TEMPLATE
Language English - United States
Codepage UNKNOWN
Size 0x8d46
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.85955
MD5 66dbd2c6ef4723550c2d309e0811ea76 🔍
SHA1 06e67133928e1ce97582074ef2a827d6cc330dda 🔍
SHA256 9794adab8d4f46b80245e1d28c300c0cc8cd53df4bb770a95ade6b7f8586750d 🔍
SHA3 6b5173be64ebf6fb8c829324be2b60bc6c0760dec2cc64c17218defea9270b02 🔍

1 (#2)

Type RT_MESSAGETABLE
Language English - United States
Codepage UNKNOWN
Size 0x70
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.77883
MD5 99983b3fd4332fba3ff938dcdb8b94b5 🔍
SHA1 ab1e7bdb547a727e4612548757b417463d4b0585 🔍
SHA256 6aba1a3676229617a729913ee3b7426fd068f9613def85a3d5356980996052d6 🔍
SHA3 0f62ee11a2f825c6259fed240cc148b548a0d4a593b1ef651a53fe5b9780a428 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x3ac
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.49985
MD5 a526b307c07856d83c7fac7efd0423ba 🔍
SHA1 8b02bc9f89c92c320d52bdc44d894d876ac796a8 🔍
SHA256 6c5c7e8896210743d7ef831fa0d7300920f2559a3861ba1765457fcfbe7e5fe4 🔍
SHA3 78e66c0040c1c3559b348c96e8568290af747226ebb31bedba970aab9f8f4be7 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 10.0.26100.9818
ProductVersion 10.0.26100.9818
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_DLL
Language English - United States
CompanyName Microsoft Corporation
FileDescription Microsoft DirectComposition Library
FileVersion (#2) 10.0.26100.9818 (WinBuild.160101.0800)
InternalName dcomp.dll
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename dcomp.dll
ProductName Microsoft® Windows® Operating System
ProductVersion (#2) 10.0.26100.9818
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2008-Mar-17 11:54:46
Version 0.0
SizeofData 34
AddressOfRawData 0x1eba0c
PointerToRawData 0x1eba0c
Referenced File dcomp.pdb

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2008-Mar-17 11:54:46
Version 0.0
SizeofData 1472
AddressOfRawData 0x1eba30
PointerToRawData 0x1eba30

UNKNOWN

Characteristics 0
TimeDateStamp 2008-Mar-17 11:54:46
Version 0.0
SizeofData 36
AddressOfRawData 0x1ec018
PointerToRawData 0x1ec018

UNKNOWN (#2)

Characteristics 0
TimeDateStamp 2008-Mar-17 11:54:46
Version 0.0
SizeofData 4
AddressOfRawData 0x1ec03c
PointerToRawData 0x1ec03c

TLS Callbacks

StartAddressOfRawData 0x1801ec060
EndAddressOfRawData 0x1801ec06c
AddressOfIndex 0x180201568
AddressOfCallbacks 0x1801c9d50
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x148
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x180200100
GuardCFCheckFunctionPointer 6444325888
GuardCFDispatchFunctionPointer 0
GuardCFFunctionTable 0
GuardCFFunctionCount 0
GuardFlags (EMPTY)
CodeIntegrity.Flags 0
CodeIntegrity.Catalog 0
CodeIntegrity.CatalogOffset 0
CodeIntegrity.Reserved 0
GuardAddressTakenIatEntryTable 0
GuardAddressTakenIatEntryCount 0
GuardLongJumpTargetTable 0
GuardLongJumpTargetCount 0

RICH Header

XOR Key 0x792645e1
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 96
Unmarked objects (#2) 1
C objects (33145) 11
ASM objects (33145) 5
C++ objects (33145) 23
Imports (33145) 9
Total imports 1382
Exports (33145) 1
C objects (LTCG) (33145) 442
253 (33145) 1
Resource objects (33145) 1
Linker (33145) 1

Errors

[*] Warning: 1447 invalid export(s) not shown.
Leave a comment

No comments yet.