libmt4j.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	libmt4j.dll
size	61479 (0xf027)
md5	79971373c2de69f88cfa6d7b1736b12a

type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0x10
TimeDateStamp	0x562bdb59
PointerToSymbolTable	0x7800
NumberOfSymbols	0x51d
SizeOfOptionalHeader	0xf0
Characteristics	0x2026
Magic	0x20b
LinkerVersion	2.25
SizeOfCode	0x3000
SizeOfInitializedData	0x5a00
SizeOfUninitializedData	0x1000
AddressOfEntryPoint	0x13e0
BaseOfCode	0x1000
ImageBase	0x63b40000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x13000
SizeOfHeaders	0x600
CheckSum	0x1b4b1
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2ec8	0x3000	R-X CODE IDATA
.data	0x4000	0x88	0x200	RW- IDATA
.rdata	0x5000	0xce0	0xe00	R-- IDATA
.pdata	0x6000	0x3d8	0x400	R-- IDATA
.xdata	0x7000	0x360	0x400	R-- IDATA
.bss	0x8000	0xfb0	0	RW- UDATA
.edata	0x9000	0x1a3	0x200	R-- IDATA
.idata	0xa000	0x8b0	0xa00	RW- IDATA
.CRT	0xb000	0x58	0x200	RW- IDATA
.tls	0xc000	0x68	0x200	RW- IDATA
.reloc	0xd000	0x70	0x200	R-- IDATA DISCARDABLE
/4	0xe000	0x50	0x200	R-- IDATA DISCARDABLE
/19	0xf000	0xe1c	0x1000	R-- IDATA DISCARDABLE
/31	0x10000	0x89	0x200	R-- IDATA DISCARDABLE
/45	0x11000	0x12d	0x200	R-- IDATA DISCARDABLE
/57	0x12000	0x48	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x9000	0x1a3
IMPORT	0xa000	0x8b0
RESOURCE	0	0
EXCEPTION	0x6000	0x3d8
SECURITY	0	0
BASERELOC	0xd000	0x70
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xc020	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xa22c	0x1f0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x63b4c000	0x63b4c060	0x63b48c0c	0x63b4b030	0	0

module_name	hint	function_name
KERNEL32.dll	216	DeleteCriticalSection
KERNEL32.dll	248	EnterCriticalSection
KERNEL32.dll	461	GetCurrentProcess
KERNEL32.dll	462	GetCurrentProcessId
KERNEL32.dll	466	GetCurrentThreadId
KERNEL32.dll	528	GetLastError
KERNEL32.dll	546	GetModuleFileNameA
KERNEL32.dll	548	GetModuleHandleA
KERNEL32.dll	551	GetModuleHandleW
KERNEL32.dll	598	GetProcAddress
KERNEL32.dll	650	GetSystemTimeAsFileTime
KERNEL32.dll	677	GetTickCount
KERNEL32.dll	761	InitializeCriticalSection
KERNEL32.dll	843	LeaveCriticalSection
KERNEL32.dll	846	LoadLibraryA
KERNEL32.dll	955	QueryPerformanceCounter
KERNEL32.dll	1025	RtlAddFunctionTable
KERNEL32.dll	1026	RtlCaptureContext
KERNEL32.dll	1033	RtlLookupFunctionEntry
KERNEL32.dll	1040	RtlVirtualUnwind
KERNEL32.dll	1183	SetUnhandledExceptionFilter
KERNEL32.dll	1196	Sleep
KERNEL32.dll	1210	TerminateProcess
KERNEL32.dll	1217	TlsGetValue
KERNEL32.dll	1230	UnhandledExceptionFilter
KERNEL32.dll	1260	VirtualProtect
KERNEL32.dll	1262	VirtualQuery
msvcrt.dll	78	__dllonexit
msvcrt.dll	83	__iob_func
msvcrt.dll	122	_amsg_exit
msvcrt.dll	201	_errno
msvcrt.dll	330	_initterm
msvcrt.dll	438	_localtime64
msvcrt.dll	439	_lock
msvcrt.dll	611	_onexit
msvcrt.dll	788	_time64
msvcrt.dll	819	_unlock
msvcrt.dll	1030	abort
msvcrt.dll	1034	asctime
msvcrt.dll	1043	atoi
msvcrt.dll	1047	calloc
msvcrt.dll	1064	fclose
msvcrt.dll	1067	fflush
msvcrt.dll	1070	fgets
msvcrt.dll	1077	fopen
msvcrt.dll	1079	fprintf
msvcrt.dll	1081	fputc
msvcrt.dll	1086	free
msvcrt.dll	1097	fwrite
msvcrt.dll	1145	malloc
msvcrt.dll	1153	memcpy
msvcrt.dll	1183	signal
msvcrt.dll	1188	sprintf
msvcrt.dll	1199	strcpy
msvcrt.dll	1201	strcspn
msvcrt.dll	1204	strlen
msvcrt.dll	1205	strncat
msvcrt.dll	1207	strncmp
msvcrt.dll	1211	strrchr
msvcrt.dll	1239	vfprintf

ord	entry_va	function_name
1	0x1e00	addNewBar
2	0x2420	callNoArgsMethod
3	0x23c0	deinitObject
4	0x1ef0	destroy
5	0x22f0	getBoolProperty
6	0x20b0	getDoubleProperty
7	0x1fd0	getIntProperty
8	0x21a0	getStringProperty
9	0x2360	initObject
10	0x1d30	newInstance
11	0x1d40	processTick
12	0x2280	setBoolProperty
13	0x2030	setDoubleProperty
14	0x1f60	setIntProperty
15	0x2110	setStringProperty

module_name	libmt4j.dll
flags	0
timestamp	2015-10-24 19:26:17
version	0.0
ordinal_base	1
nFunctions	15
nNames	15
Names(15)	0x9064
Functions(15)	0x9028
NameOrdinals(15)	0x90a0

show previews

offset	size	type	comment
0	61479	DLL	10/24/2015 19:26:17	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x8c0c