module.560.3ef44a68.734d0000.dll

info
MZ
PE
exports
foremost
hexdump
disasm
log
discuss
donate

filename	module.560.3ef44a68.734d0000.dll
size	51200 (0xc800)
md5	374c0bc6f480ee11188c5c43d216e03a

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
149	30729	3
1	0	132
147	30729	21
146	30729	1
131	30729	30
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4ce7b9a0
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0xa800
SizeOfInitializedData	0x1a00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x125e
BaseOfCode	0x1000
BaseOfData	0xc000
ImageBase	0x734d0000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0xf000
SizeOfHeaders	0x600
CheckSum	0xe860
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xa7f7	0xa800	R-X CODE
.data	0xc000	0xdcc	0xe00	RW- IDATA
.rsrc	0xd000	0x418	0x600	R-- IDATA
.reloc	0xe000	0x468	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x17b8	0x425
IMPORT	0xafc0	0xdc
RESOURCE	0xd000	0x418
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xe000	0x468
DEBUG	0xb798	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x4ea8	0x40
Bound_IAT	0x278	0x18c
IAT	0x1000	0x110
Delay_IAT	0xa7c4	0xe0
CLR_Header	0	0

ord	entry_va	function_name
1	0x52ff	NetGetDisplayInformationIndex
2	0x77c9	NetGroupAdd
3	0x79b5	NetGroupAddUser
4	0x79d3	NetGroupDel
5	0x79f3	NetGroupDelUser
6	0x7a11	NetGroupEnum
7	0x2c04	NetGroupGetInfo
8	0x7ed0	NetGroupGetUsers
9	0x8180	NetGroupSetInfo
10	0x832c	NetGroupSetUsers
11	0x8c32	NetLocalGroupAdd
12	0x8d5e	NetLocalGroupAddMember
13	0x92fe	NetLocalGroupAddMembers
14	0x8d7c	NetLocalGroupDel
15	0x8e00	NetLocalGroupDelMember
16	0x9322	NetLocalGroupDelMembers
17	0x8e1e	NetLocalGroupEnum
18	0x2ba1	NetLocalGroupGetInfo
19	0x21be	NetLocalGroupGetMembers
20	0x91bc	NetLocalGroupSetInfo
21	0x92da	NetLocalGroupSetMembers
22	0x4f6f	NetQueryDisplayInformation
23	0x5648	NetUserAdd
24	0x6d0f	NetUserChangePassword
25	0x581f	NetUserDel
26	0x59cf	NetUserEnum
27	0x5dfa	NetUserGetGroups
28	0x1be2	NetUserGetInfo
29	0x28aa	NetUserGetLocalGroups
30	0x64a3	NetUserModalsGet
31	0x67b3	NetUserModalsSet
32	0x608e	NetUserSetGroups
33	0x5d16	NetUserSetInfo
34	0x9cbf	NetValidatePasswordPolicy
35	0x9ec3	NetValidatePasswordPolicyFree

module_name	samcli.dll
flags	0
timestamp	2010-11-20 09:32:23
version	0.0
ordinal_base	1
nFunctions	35
nNames	35
Names(35)	0x186c
Functions(35)	0x17e0
NameOrdinals(35)	0x18f8

show previews

offset	size	type	comment
0	51200	DLL	11/20/2010 12:05:52	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x278