nslync.dll

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	nslync.dll
size	759296 (0xb9600)
md5	455f950fb8420f49f5c10cf7e6e665f6

type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
241	40116	12
243	40116	164
242	40116	25
259	26706	9
261	27038	9
261	26706	60
260	26706	31
203	65501	11
1	0	167
265	27034	10
256	27034	1
255	27034	1
258	27034	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x5f2a5ebc
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	14.16
SizeOfCode	0x77000
SizeOfInitializedData	0x43e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x48094
BaseOfCode	0x1000
ImageBase	0x180000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xbf000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x120
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x76f18	0x77000	R-X CODE
.rdata	0x78000	0x3503a	0x35200	R-- IDATA
.data	0xae000	0x71fc	0x5600	RW- IDATA
.pdata	0xb6000	0x5f04	0x6000	R-- IDATA
.rsrc	0xbc000	0x1e0	0x200	R-- IDATA
.reloc	0xbd000	0x1654	0x1800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0xac0c0	0x70
IMPORT	0xac130	0x78
RESOURCE	0xbc000	0x1e0
EXCEPTION	0xb6000	0x5f04
SECURITY	0	0
BASERELOC	0xbd000	0x1654
DEBUG	0x93c30	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x93da0	0x28
LOAD_CONFIG	0x93ca0	0x100
Bound_IAT	0	0
IAT	0x78000	0x488
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x18009a2c0	0x18009a2c8	0x1800b4104	0x180078688	0	0x300000

show previews

type	name	size	cp
MANIFEST	#2	381	0

module_name	hint	ord	function_name
KERNEL32.dll	528		GetCurrentProcessId
KERNEL32.dll	599		GetLocalTime
KERNEL32.dll	532		GetCurrentThreadId
KERNEL32.dll	572		GetFileAttributesW
KERNEL32.dll	267		DeleteFileW
KERNEL32.dll	980		MultiByteToWideChar
KERNEL32.dll	1501		WideCharToMultiByte
KERNEL32.dll	598		GetLastError
KERNEL32.dll	761		GetTickCount
KERNEL32.dll	1388		SystemTimeToFileTime
KERNEL32.dll	949		LocalFree
KERNEL32.dll	416		FormatMessageW
KERNEL32.dll	415		FormatMessageA
KERNEL32.dll	179		CreateEventA
KERNEL32.dll	182		CreateEventW
KERNEL32.dll	127		CloseHandle
KERNEL32.dll	824		HeapAlloc
KERNEL32.dll	681		GetProcessHeap
KERNEL32.dll	616		GetModuleFileNameA
KERNEL32.dll	1279		SetEvent
KERNEL32.dll	1467		WaitForSingleObject
KERNEL32.dll	206		CreateMutexA
KERNEL32.dll	1005		OpenMutexW
KERNEL32.dll	343		ExitProcess
KERNEL32.dll	297		EnterCriticalSection
KERNEL32.dll	1465		WaitForMultipleObjects
KERNEL32.dll	933		LeaveCriticalSection
KERNEL32.dll	1393		TerminateThread
KERNEL32.dll	1410		TlsAlloc
KERNEL32.dll	1082		QueueUserAPC
KERNEL32.dll	262		DeleteCriticalSection
KERNEL32.dll	1411		TlsFree
KERNEL32.dll	848		InitializeCriticalSection
KERNEL32.dll	733		GetSystemTimeAsFileTime
KERNEL32.dll	608		GetLongPathNameA
KERNEL32.dll	746		GetTempPathW
KERNEL32.dll	828		HeapFree
KERNEL32.dll	463		GetCommandLineW
KERNEL32.dll	833		HeapSize
KERNEL32.dll	1520		WriteConsoleW
KERNEL32.dll	1328		SetStdHandle
KERNEL32.dll	1276		SetEnvironmentVariableA
KERNEL32.dll	419		FreeEnvironmentStringsW
KERNEL32.dll	558		GetEnvironmentStringsW
KERNEL32.dll	462		GetCommandLineA
KERNEL32.dll	653		GetOEMCP
KERNEL32.dll	885		IsValidCodePage
KERNEL32.dll	387		FindNextFileA
KERNEL32.dll	371		FindFirstFileExA
KERNEL32.dll	831		HeapReAlloc
KERNEL32.dll	768		GetTimeZoneInformation
KERNEL32.dll	332		EnumSystemLocalesW
KERNEL32.dll	716		GetStringTypeW
KERNEL32.dll	293		EncodePointer
KERNEL32.dll	255		DecodePointer
KERNEL32.dll	1305		SetLastError
KERNEL32.dll	849		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1387		SwitchToThread
KERNEL32.dll	1412		TlsGetValue
KERNEL32.dll	1413		TlsSetValue
KERNEL32.dll	621		GetModuleHandleW
KERNEL32.dll	676		GetProcAddress
KERNEL32.dll	147		CompareStringW
KERNEL32.dll	921		LCMapStringW
KERNEL32.dll	602		GetLocaleInfoW
KERNEL32.dll	441		GetCPInfo
KERNEL32.dll	178		CreateDirectoryW
KERNEL32.dll	194		CreateFileW
KERNEL32.dll	569		GetFileAttributesExW
KERNEL32.dll	1177		RemoveDirectoryW
KERNEL32.dll	1273		SetEndOfFile
KERNEL32.dll	1292		SetFilePointerEx
KERNEL32.dll	278		DeviceIoControl
KERNEL32.dll	973		MoveFileExW
KERNEL32.dll	366		FindClose
KERNEL32.dll	27		AreFileApisANSI
KERNEL32.dll	1198		RtlCaptureContext
KERNEL32.dll	1205		RtlLookupFunctionEntry
KERNEL32.dll	1212		RtlVirtualUnwind
KERNEL32.dll	1426		UnhandledExceptionFilter
KERNEL32.dll	1362		SetUnhandledExceptionFilter
KERNEL32.dll	527		GetCurrentProcess
KERNEL32.dll	1392		TerminateProcess
KERNEL32.dll	880		IsProcessorFeaturePresent
KERNEL32.dll	1190		ResetEvent
KERNEL32.dll	1468		WaitForSingleObjectEx
KERNEL32.dll	874		IsDebuggerPresent
KERNEL32.dll	709		GetStartupInfoW
KERNEL32.dll	1072		QueryPerformanceCounter
KERNEL32.dll	852		InitializeSListHead
KERNEL32.dll	1073		QueryPerformanceFrequency
KERNEL32.dll	1172		ReleaseSemaphore
KERNEL32.dll	1466		WaitForMultipleObjectsEx
KERNEL32.dll	996		OpenEventA
KERNEL32.dll	1370		SetWaitableTimer
KERNEL32.dll	1377		Sleep
KERNEL32.dll	1196		ResumeThread
KERNEL32.dll	618		GetModuleHandleA
KERNEL32.dll	243		CreateWaitableTimerA
KERNEL32.dll	1211		RtlUnwindEx
KERNEL32.dll	856		InterlockedFlushSList
KERNEL32.dll	1207		RtlPcToFileHeader
KERNEL32.dll	1092		RaiseException
KERNEL32.dll	420		FreeLibrary
KERNEL32.dll	938		LoadLibraryExW
KERNEL32.dll	620		GetModuleHandleExW
KERNEL32.dll	231		CreateThread
KERNEL32.dll	344		ExitThread
KERNEL32.dll	421		FreeLibraryAndExitThread
KERNEL32.dll	426		GetACP
KERNEL32.dll	711		GetStdHandle
KERNEL32.dll	581		GetFileType
KERNEL32.dll	408		FlushFileBuffers
KERNEL32.dll	1521		WriteFile
KERNEL32.dll	482		GetConsoleCP
KERNEL32.dll	500		GetConsoleMode
KERNEL32.dll	1108		ReadFile
KERNEL32.dll	1106		ReadConsoleW
KERNEL32.dll	538		GetDateFormatW
KERNEL32.dll	766		GetTimeFormatW
KERNEL32.dll	887		IsValidLocale
KERNEL32.dll	773		GetUserDefaultLCID
KERNEL32.dll	1210		RtlUnwind
ADVAPI32.dll	658		RegQueryValueExW
ADVAPI32.dll	645		RegOpenKeyExW
ADVAPI32.dll	596		RegCloseKey
SHELL32.dll	244		SHGetSpecialFolderPathW
SHELL32.dll	242		SHGetSpecialFolderPathA
ole32.dll	510		StringFromGUID2
ole32.dll	71		CoGetObject
ole32.dll	30		CoCreateInstance
ole32.dll	83		CoInitialize
WS2_32.dll		112
WS2_32.dll		111
WS2_32.dll		115
WS2_32.dll		14
WS2_32.dll	90		WSAStringToAddressW
WS2_32.dll		116
WS2_32.dll	19		WSAAddressToStringW
WS2_32.dll		8

ord	entry_va	function_name
1	0x11c10	GetConfigParam
2	0x11920	Send
3	0x11bb0	ToLogFile

module_name	nslync.dll
flags	0
timestamp	2106-02-07 06:28:15
version	0.0
ordinal_base	1
nFunctions	3
nNames	3
Names(3)	0xac0f4
Functions(3)	0xac0e8
NameOrdinals(3)	0xac100

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	753712	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0xb4104