webmail.dll

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	webmail.dll
size	39936 (0x9c00)
md5	cd1f1a47557d3a78c4679d1f93447f15

type	PE32+ executable (DLL) (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
147	30729	10
260	33218	7
259	33218	2
257	30795	6
261	33218	20
257	33218	7
1	0	158
265	33523	2
255	33523	1
258	33523	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x666b23fc
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x2022
Magic	0x20b
LinkerVersion	14.39
SizeOfCode	0x5400
SizeOfInitializedData	0x4600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x57f4
BaseOfCode	0x1000
ImageBase	0x180000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xf000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x5244	0x5400	R-X CODE
.rdata	0x7000	0x333c	0x3400	R-- IDATA
.data	0xb000	0x550	0x400	RW- IDATA
.pdata	0xc000	0x6b4	0x800	R-- IDATA
.rsrc	0xd000	0xf8	0x200	R-- IDATA
.reloc	0xe000	0x98	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x8e88	0xf0
RESOURCE	0xd000	0xf8
EXCEPTION	0xc000	0x6b4
SECURITY	0	0
BASERELOC	0xe000	0x98
DEBUG	0x7920	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x77e0	0x140
Bound_IAT	0	0
IAT	0x7000	0x3e8
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#2	145	0

module_name	hint	function_name
MSVCP140.dll	1221	public: void __cdecl std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) __ptr64 ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
MSVCP140.dll	137	public: virtual __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::~basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	1237	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::showmanyc(void) __ptr64 ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
MSVCP140.dll	1347	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsgetn(char * __ptr64, __int64) __ptr64 ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
MSVCP140.dll	1350	protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsputn(char const * __ptr64, __int64) __ptr64 ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
MSVCP140.dll	125	public: virtual __cdecl std::basic_ios<char, struct std::char_traits<char> >::~basic_ios<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	134	public: virtual __cdecl std::basic_ostream<char, struct std::char_traits<char> >::~basic_ostream<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	262	public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 (__cdecl*)(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64)) __ptr64 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
MSVCP140.dll	268	public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(unsigned __int64) __ptr64 ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
MSVCP140.dll	131	public: virtual __cdecl std::basic_istream<char, struct std::char_traits<char> >::~basic_istream<char, struct std::char_traits<char> >(void) __ptr64 ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
MSVCP140.dll	965	public: bool __cdecl std::ios_base::good(void)const __ptr64 ?good@ios_base@std@@QEBA_NXZ
MSVCP140.dll	306	public: __cdecl std::ios_base::operator bool(void)const __ptr64 ??Bios_base@std@@QEBA_NXZ
MSVCP140.dll	669	public: bool __cdecl std::codecvt_base::always_noconv(void)const __ptr64 ?always_noconv@codecvt_base@std@@QEBA_NXZ
MSVCP140.dll	305	public: __cdecl std::locale::id::operator unsigned __int64(void) __ptr64 ??Bid@locale@std@@QEAA_KXZ
MSVCP140.dll	1075	public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::out(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64 ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
MSVCP140.dll	1018	public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::in(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64 ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
MSVCP140.dll	26	public: __cdecl std::basic_istream<char, struct std::char_traits<char> >::basic_istream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64, bool) __ptr64 ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
MSVCP140.dll	872	public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::flush(void) __ptr64 ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
MSVCP140.dll	580	public: void __cdecl std::basic_ostream<char, struct std::char_traits<char> >::_Osfx(void) __ptr64 ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
MSVCP140.dll	37	public: __cdecl std::basic_ostream<char, struct std::char_traits<char> >::basic_ostream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64, bool) __ptr64 ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
MSVCP140.dll	12	protected: __cdecl std::basic_ios<char, struct std::char_traits<char> >::basic_ios<char, struct std::char_traits<char> >(void) __ptr64 ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
MSVCP140.dll	109	public: __cdecl std::_Lockit::_Lockit(int) __ptr64 ??0_Lockit@std@@QEAA@H@Z
MSVCP140.dll	501	protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Init(void) __ptr64 ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
MSVCP140.dll	1319	public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::unshift(struct _Mbstatet & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64 ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
MSVCP140.dll	1246	public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputc(char) __ptr64 ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
MSVCP140.dll	960	public: class std::locale __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::getloc(void)const __ptr64 ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
MSVCP140.dll	47	protected: __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64 ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
MSVCP140.dll	1332	public: char __cdecl std::basic_ios<char, struct std::char_traits<char> >::widen(char)const __ptr64 ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
MSVCP140.dll	1121	public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::put(char) __ptr64 ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
MSVCP140.dll	1249	public: __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputn(char const * __ptr64, __int64) __ptr64 ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
MSVCP140.dll	433	public: static unsigned __int64 __cdecl std::codecvt<char, char, struct _Mbstatet>::_Getcat(class std::locale::facet const * __ptr64 * __ptr64, class std::locale const * __ptr64) ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
MSVCP140.dll	969	public: static class std::locale::id std::codecvt<char, char, struct _Mbstatet>::id ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
MSVCP140.dll	427	struct _iobuf * __ptr64 __cdecl std::_Fiopen(char const * __ptr64, int, int) ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
MSVCP140.dll	1311	int __cdecl std::uncaught_exceptions(void) ?uncaught_exceptions@std@@YAHXZ
MSVCP140.dll	692	class std::basic_ostream<char, struct std::char_traits<char> > std::cout ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
MSVCP140.dll	674	class std::basic_ostream<char, struct std::char_traits<char> > std::cerr ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
MSVCP140.dll	469	private: static class std::locale::_Locimp * __ptr64 __cdecl std::locale::_Getgloballocale(void) ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
MSVCP140.dll	654	void __cdecl std::_Xlength_error(char const * __ptr64) ?_Xlength_error@std@@YAXPEBD@Z
MSVCP140.dll	165	public: __cdecl std::_Lockit::~_Lockit(void) __ptr64 ??1_Lockit@std@@QEAA@XZ
MSVCP140.dll	213	public: class std::basic_istream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_istream<char, struct std::char_traits<char> >::operator>>(unsigned __int64 & __ptr64) __ptr64 ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
KERNEL32.dll	1284	RtlVirtualUnwind
KERNEL32.dll	1136	QueryPerformanceCounter
KERNEL32.dll	1444	SetUnhandledExceptionFilter
KERNEL32.dll	1510	UnhandledExceptionFilter
KERNEL32.dll	1277	RtlLookupFunctionEntry
KERNEL32.dll	936	IsProcessorFeaturePresent
KERNEL32.dll	562	GetCurrentProcess
KERNEL32.dll	563	GetCurrentProcessId
KERNEL32.dll	567	GetCurrentThreadId
KERNEL32.dll	778	GetSystemTimeAsFileTime
KERNEL32.dll	1082	OutputDebugStringW
KERNEL32.dll	928	IsDebuggerPresent
KERNEL32.dll	1460	Sleep
KERNEL32.dll	109	Beep
KERNEL32.dll	772	GetSystemInfo
KERNEL32.dll	1620	WriteProcessMemory
KERNEL32.dll	1179	ReadProcessMemory
KERNEL32.dll	1544	VirtualQueryEx
KERNEL32.dll	1070	OpenProcess
KERNEL32.dll	1103	Process32Next
KERNEL32.dll	1101	Process32First
KERNEL32.dll	268	CreateToolhelp32Snapshot
KERNEL32.dll	259	CreateThread
KERNEL32.dll	148	CloseHandle
KERNEL32.dll	291	DeleteCriticalSection
KERNEL32.dll	903	InitializeCriticalSectionEx
KERNEL32.dll	637	GetLastError
KERNEL32.dll	1010	LocalFree
KERNEL32.dll	906	InitializeSListHead
KERNEL32.dll	1269	RtlCaptureContext
USER32.dll	289	GetAsyncKeyState
ADVAPI32.dll	523	OpenProcessToken
ADVAPI32.dll	123	ConvertSidToStringSidW
ADVAPI32.dll	347	GetTokenInformation
VCRUNTIME140_1.dll		__CxxFrameHandler4
VCRUNTIME140.dll	37	__std_type_info_destroy_list
VCRUNTIME140.dll	35	__std_terminate
VCRUNTIME140.dll	33	__std_exception_copy
VCRUNTIME140.dll	34	__std_exception_destroy
VCRUNTIME140.dll	61	memmove
VCRUNTIME140.dll	62	memset
VCRUNTIME140.dll	8	__C_specific_handler
VCRUNTIME140.dll	1	_CxxThrowException
VCRUNTIME140.dll	60	memcpy
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-heap-l1-1-0.dll	17	_msize
api-ms-win-crt-runtime-l1-1-0.dll	51	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	34	_execute_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	24	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	57	_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	63	_seh_filter_dll
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-stdio-l1-1-0.dll	47	_fseeki64
api-ms-win-crt-stdio-l1-1-0.dll	119	fflush
api-ms-win-crt-stdio-l1-1-0.dll	152	setvbuf
api-ms-win-crt-stdio-l1-1-0.dll	157	ungetc
api-ms-win-crt-stdio-l1-1-0.dll	127	fputc
api-ms-win-crt-stdio-l1-1-0.dll	120	fgetc
api-ms-win-crt-stdio-l1-1-0.dll	116	fclose
api-ms-win-crt-stdio-l1-1-0.dll	57	_get_stream_buffer_pointers
api-ms-win-crt-stdio-l1-1-0.dll	131	fread
api-ms-win-crt-stdio-l1-1-0.dll	138	fwrite
api-ms-win-crt-stdio-l1-1-0.dll	121	fgetpos
api-ms-win-crt-stdio-l1-1-0.dll	136	fsetpos
api-ms-win-crt-multibyte-l1-1-0.dll	107	_mbsicmp
api-ms-win-crt-filesystem-l1-1-0.dll	36	_unlock_file
api-ms-win-crt-filesystem-l1-1-0.dll	22	_lock_file

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	34352	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK