kws.dll - Mystic AVS SSL API Module

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	kws.dll
size	159232 (0x26e00)
md5	00fd7ed29058ac80f728f7b3a68fd16c

type	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0xd
TimeDateStamp	0
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x222e
Magic	0x20b
LinkerVersion	2.31
SizeOfCode	0x10200
SizeOfInitializedData	0x26a00
SizeOfUninitializedData	0xa00
AddressOfEntryPoint	0x13c0
BaseOfCode	0x1000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x31000
SizeOfHeaders	0x400
CheckSum	0x33bd6
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x101e8	0x10200	R-X CODE IDATA
.data	0x12000	0x10710	0x10800	RW- IDATA
.rdata	0x23000	0x2790	0x2800	R-- IDATA
.buildid	0x26000	0x35	0x200	R-- IDATA
.pdata	0x27000	0x9b4	0xa00	R-- IDATA
.xdata	0x28000	0x9d0	0xa00	R-- IDATA
.bss	0x29000	0x900	0	RW- UDATA
.edata	0x2a000	0x11f	0x200	R-- IDATA
.idata	0x2b000	0x1420	0x1600	RW- IDATA
.CRT	0x2d000	0x58	0x200	RW- IDATA
.tls	0x2e000	0x68	0x200	RW- IDATA
.rsrc	0x2f000	0x3e8	0x400	RW- IDATA
.reloc	0x30000	0x100	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x2a000	0x11f
IMPORT	0x2b000	0x1420
RESOURCE	0x2f000	0x3e8
EXCEPTION	0x27000	0x9b4
SECURITY	0	0
BASERELOC	0x30000	0x100
DEBUG	0x26000	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x2e020	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2b510	0x470
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x1002e000	0x1002e060	0x100295ac	0x1002d030	0	0

show previews

type	name	size	cp
VERSION	#1	912	0

module_name	hint	function_name
IPHLPAPI.DLL	82	GetBestRoute
IPHLPAPI.DLL	104	GetIpAddrTable
KERNEL32.dll	207	DebugBreak
KERNEL32.dll	217	DeleteCriticalSection
KERNEL32.dll	250	EnterCriticalSection
KERNEL32.dll	295	ExitProcess
KERNEL32.dll	463	GetCurrentProcess
KERNEL32.dll	464	GetCurrentProcessId
KERNEL32.dll	468	GetCurrentThreadId
KERNEL32.dll	530	GetLastError
KERNEL32.dll	550	GetModuleHandleA
KERNEL32.dll	600	GetProcAddress
KERNEL32.dll	652	GetSystemTimeAsFileTime
KERNEL32.dll	679	GetTickCount
KERNEL32.dll	763	InitializeCriticalSection
KERNEL32.dll	787	IsDebuggerPresent
KERNEL32.dll	845	LeaveCriticalSection
KERNEL32.dll	892	MultiByteToWideChar
KERNEL32.dll	928	OutputDebugStringA
KERNEL32.dll	959	QueryPerformanceCounter
KERNEL32.dll	1030	RtlAddFunctionTable
KERNEL32.dll	1031	RtlCaptureContext
KERNEL32.dll	1038	RtlLookupFunctionEntry
KERNEL32.dll	1045	RtlVirtualUnwind
KERNEL32.dll	1188	SetUnhandledExceptionFilter
KERNEL32.dll	1201	Sleep
KERNEL32.dll	1215	TerminateProcess
KERNEL32.dll	1222	TlsGetValue
KERNEL32.dll	1235	UnhandledExceptionFilter
KERNEL32.dll	1259	VirtualAlloc
KERNEL32.dll	1262	VirtualFree
KERNEL32.dll	1265	VirtualProtect
KERNEL32.dll	1267	VirtualQuery
KERNEL32.dll	1299	WideCharToMultiByte
msvcrt.dll	79	__dllonexit
msvcrt.dll	84	__iob_func
msvcrt.dll	126	_amsg_exit
msvcrt.dll	205	_errno
msvcrt.dll	296	_getch
msvcrt.dll	334	_initterm
msvcrt.dll	441	_lock
msvcrt.dll	605	_memicmp
msvcrt.dll	617	_onexit
msvcrt.dll	679	_snprintf
msvcrt.dll	731	_strdup
msvcrt.dll	741	_stricmp
msvcrt.dll	824	_unlock
msvcrt.dll	855	_vsnprintf
msvcrt.dll	862	_vsnwprintf
msvcrt.dll	1034	abort
msvcrt.dll	1048	atoi
msvcrt.dll	1052	calloc
msvcrt.dll	1072	fflush
msvcrt.dll	1084	fprintf
msvcrt.dll	1091	free
msvcrt.dll	1103	fwrite
msvcrt.dll	1108	getenv
msvcrt.dll	1121	islower
msvcrt.dll	1124	isspace
msvcrt.dll	1125	isupper
msvcrt.dll	1139	isxdigit
msvcrt.dll	1150	malloc
msvcrt.dll	1157	memcmp
msvcrt.dll	1158	memcpy
msvcrt.dll	1159	memmove
msvcrt.dll	1164	perror
msvcrt.dll	1167	printf
msvcrt.dll	1178	realloc
msvcrt.dll	1188	signal
msvcrt.dll	1197	sscanf
msvcrt.dll	1201	strchr
msvcrt.dll	1202	strcmp
msvcrt.dll	1209	strlen
msvcrt.dll	1212	strncmp
msvcrt.dll	1213	strncpy
msvcrt.dll	1218	strstr
msvcrt.dll	1223	strtoul
msvcrt.dll	1244	vfprintf
msvcrt.dll	1259	wcscmp
msvcrt.dll	1265	wcslen
msvcrt.dll	1276	wcsstr
Secur32.dll	2	AcquireCredentialsHandleA
Secur32.dll	8	ApplyControlToken
Secur32.dll	17	DecryptMessage
Secur32.dll	18	DeleteSecurityContext
Secur32.dll	21	EncryptMessage
Secur32.dll	37	InitializeSecurityContextA
Secur32.dll	52	QueryContextAttributesA
WS2_32.dll	44	WSAGetLastError
WS2_32.dll	149	bind
WS2_32.dll	150	closesocket
WS2_32.dll	151	connect
WS2_32.dll	152	freeaddrinfo
WS2_32.dll	153	getaddrinfo
WS2_32.dll	155	gethostbyname
WS2_32.dll	156	gethostname
WS2_32.dll	157	getnameinfo
WS2_32.dll	163	getsockname
WS2_32.dll	166	htons
WS2_32.dll	167	inet_addr
WS2_32.dll	168	inet_ntoa
WS2_32.dll	175	recv
WS2_32.dll	177	select
WS2_32.dll	178	send
WS2_32.dll	179	sendto
WS2_32.dll	180	setsockopt
WS2_32.dll	1	socket
avs2-ea3.dll	10	XEmdwapa00000d
avs2-ea3.dll	2	XEmdwapa00001e
avs2-ea3.dll	3	XEmdwapa000020
avs2-ea3.dll	8	XEmdwapa000036
avs2-ea3.dll	1	XEmdwapa00003a
avs2-core.dll	3	XCgsqzn0000007
avs2-core.dll	12	XCgsqzn0000077
avs2-core.dll	13	XCgsqzn0000078
avs2-core.dll	14	XCgsqzn0000079
avs2-core.dll	15	XCgsqzn000007a
avs2-core.dll	16	XCgsqzn000007b
avs2-core.dll	17	XCgsqzn000007c
avs2-core.dll	18	XCgsqzn000007d
avs2-core.dll	19	XCgsqzn000007e
avs2-core.dll	20	XCgsqzn000007f
avs2-core.dll	21	XCgsqzn0000080
avs2-core.dll	22	XCgsqzn0000081
avs2-core.dll	23	XCgsqzn0000082
avs2-core.dll	24	XCgsqzn0000086
avs2-core.dll	25	XCgsqzn000008c
avs2-core.dll	26	XCgsqzn000008d
avs2-core.dll	27	XCgsqzn000008e
avs2-core.dll	28	XCgsqzn000008f
avs2-core.dll	34	XCgsqzn00000a2
avs2-core.dll	48	XCgsqzn000017a
avs2-core.dll	49	XCgsqzn000017b
avs2-core.dll	50	XCgsqzn000017c
avs2-core.dll	1	XCgsqzn000017d

ord	entry_va	function_name
1	0x96c0	nat_traversal_init_api
2	0x9740	nat_traversal_upnp_fini
3	0x9750	nat_traversal_upnp_get_ip
4	0x9860	nat_traversal_upnp_init
5	0x103f0	ssl_protocol_enable_fqdn_validation
6	0x10420	ssl_protocol_fini
7	0x10460	ssl_protocol_init

module_name	kws.dll
flags	0
timestamp	2018-12-20 07:51:56
version	0.0
ordinal_base	1
nFunctions	7
nNames	7
Names(7)	0x2a044
Functions(7)	0x2a028
NameOrdinals(7)	0x2a060

StringTable 000004B0

CompanyName	Microsoft Corporation
FileDescription	Mystic AVS SSL API Module
FileVersion	5.2.3790.1830 (toasterworks.20181220-0024)
InternalName	kws.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	kws.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	5.2.3790.1830

VS_FIXEDFILEINFO

FileVersion	5.2.3790.1830
ProductVersion	5.2.3790.1830
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	153648	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x295ac

kws.dll-

MZ Header

DOS stub

PE Header

Sections

Data Directory

TLS

StringTable 000004B0

VS_FIXEDFILEINFO

kws.dll
-