metsrv.dll

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	metsrv.dll
size	752128 (0xb7a00)
md5	e12f2ff225cf6a50b50a12442c1fb214

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
171	40219	38
131	30729	337
1	0	176
147	30729	13
158	40219	31
170	40219	179
155	40219	1
157	40219	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x504f8c77
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x75e00
SizeOfInitializedData	0x47000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x63bdb
BaseOfCode	0x1000
BaseOfData	0x77000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0xbf000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x100
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x75d86	0x75e00	R-X CODE
.rdata	0x77000	0x262d5	0x26400	R-- IDATA
.data	0x9e000	0x16f08	0x11800	RW- IDATA
.reloc	0xb5000	0x9ab0	0x9c00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x9c8c0	0xa15
IMPORT	0x9bacc	0x78
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xb5000	0x7e98
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x77000	0x278
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
WS2_32.dll		3
WS2_32.dll		22
WS2_32.dll		111
WS2_32.dll		112
WS2_32.dll		19
WS2_32.dll		14
WS2_32.dll		8
WS2_32.dll	33		WSADuplicateSocketA
WS2_32.dll		18
WS2_32.dll		16
WININET.dll	115		InternetCrackUrlA
WININET.dll	113		InternetConnectA
WININET.dll	107		InternetCloseHandle
WININET.dll	91		HttpSendRequestA
WININET.dll	172		InternetSetOptionA
WININET.dll	157		InternetQueryOptionA
WININET.dll	159		InternetReadFile
WININET.dll	87		HttpOpenRequestA
WININET.dll	151		InternetOpenA
KERNEL32.dll	1189		SetUnhandledExceptionFilter
KERNEL32.dll	453		GetCurrentThreadId
KERNEL32.dll	1202		Sleep
KERNEL32.dll	354		FreeLibrary
KERNEL32.dll	449		GetCurrentProcessId
KERNEL32.dll	448		GetCurrentProcess
KERNEL32.dll	1136		SetHandleInformation
KERNEL32.dll	1139		SetLastError
KERNEL32.dll	674		GetVersion
KERNEL32.dll	871		MultiByteToWideChar
KERNEL32.dll	499		GetFileType
KERNEL32.dll	612		GetStdHandle
KERNEL32.dll	1297		WideCharToMultiByte
KERNEL32.dll	344		FlushInstructionCache
KERNEL32.dll	281		ExitProcess
KERNEL32.dll	659		GetTickCount
KERNEL32.dll	935		QueryPerformanceCounter
KERNEL32.dll	703		GlobalMemoryStatus
KERNEL32.dll	82		CloseHandle
KERNEL32.dll	831		LoadLibraryW
KERNEL32.dll	676		GetVersionExW
KERNEL32.dll	342		FlushConsoleInputBuffer
KERNEL32.dll	1110		SetEnvironmentVariableA
KERNEL32.dll	100		CompareStringW
KERNEL32.dll	617		GetStringTypeW
KERNEL32.dll	282		ExitThread
KERNEL32.dll	514		GetLastError
KERNEL32.dll	1260		VirtualFree
KERNEL32.dll	1257		VirtualAlloc
KERNEL32.dll	533		GetModuleHandleA
KERNEL32.dll	828		LoadLibraryA
KERNEL32.dll	581		GetProcAddress
KERNEL32.dll	1326		WriteProcessMemory
KERNEL32.dll	1265		VirtualQuery
KERNEL32.dll	302		FindClose
KERNEL32.dll	1263		VirtualProtect
KERNEL32.dll	1316		WriteConsoleW
KERNEL32.dll	467		GetDriveTypeW
KERNEL32.dll	1107		SetEndOfFile
KERNEL32.dll	586		GetProcessHeap
KERNEL32.dll	724		HeapSize
KERNEL32.dll	143		CreateFileW
KERNEL32.dll	447		GetCurrentDirectoryW
KERNEL32.dll	909		PeekNamedPipe
KERNEL32.dll	492		GetFileInformationByHandle
KERNEL32.dll	504		GetFullPathNameA
KERNEL32.dll	1126		SetFilePointer
KERNEL32.dll	1159		SetStdHandle
KERNEL32.dll	343		FlushFileBuffers
KERNEL32.dll	410		GetConsoleCP
KERNEL32.dll	664		GetTimeZoneInformation
KERNEL32.dll	813		LCMapStringW
KERNEL32.dll	960		ReadFile
KERNEL32.dll	496		GetFileSize
KERNEL32.dll	136		CreateFileA
KERNEL32.dll	1317		WriteFile
KERNEL32.dll	155		CreateMutexA
KERNEL32.dll	1273		WaitForSingleObject
KERNEL32.dll	1018		ReleaseMutex
KERNEL32.dll	130		CreateEventA
KERNEL32.dll	1113		SetEvent
KERNEL32.dll	181		CreateThread
KERNEL32.dll	1043		ResumeThread
KERNEL32.dll	1217		TerminateThread
KERNEL32.dll	1271		WaitForMultipleObjects
KERNEL32.dll	1213		SystemTimeToFileTime
KERNEL32.dll	631		GetSystemTime
KERNEL32.dll	1274		WaitForSingleObjectEx
KERNEL32.dll	1258		VirtualAllocEx
KERNEL32.dll	232		DuplicateHandle
KERNEL32.dll	896		OpenProcess
KERNEL32.dll	1220		Thread32Next
KERNEL32.dll	1210		SuspendThread
KERNEL32.dll	901		OpenThread
KERNEL32.dll	1219		Thread32First
KERNEL32.dll	190		CreateToolhelp32Snapshot
KERNEL32.dll	1266		VirtualQueryEx
KERNEL32.dll	675		GetVersionExA
KERNEL32.dll	169		CreateRemoteThread
KERNEL32.dll	719		HeapFree
KERNEL32.dll	715		HeapAlloc
KERNEL32.dll	633		GetSystemTimeAsFileTime
KERNEL32.dll	722		HeapReAlloc
KERNEL32.dll	390		GetCommandLineA
KERNEL32.dll	238		EnterCriticalSection
KERNEL32.dll	825		LeaveCriticalSection
KERNEL32.dll	293		FileTimeToSystemTime
KERNEL32.dll	292		FileTimeToLocalFileTime
KERNEL32.dll	466		GetDriveTypeA
KERNEL32.dll	307		FindFirstFileExA
KERNEL32.dll	1069		SetConsoleCtrlHandler
KERNEL32.dll	949		ReadConsoleInputA
KERNEL32.dll	1085		SetConsoleMode
KERNEL32.dll	428		GetConsoleMode
KERNEL32.dll	717		HeapCreate
KERNEL32.dll	718		HeapDestroy
KERNEL32.dll	536		GetModuleHandleW
KERNEL32.dll	532		GetModuleFileNameW
KERNEL32.dll	1235		UnhandledExceptionFilter
KERNEL32.dll	768		IsDebuggerPresent
KERNEL32.dll	1216		TerminateProcess
KERNEL32.dll	772		IsProcessorFeaturePresent
KERNEL32.dll	1221		TlsAlloc
KERNEL32.dll	1223		TlsGetValue
KERNEL32.dll	1224		TlsSetValue
KERNEL32.dll	1222		TlsFree
KERNEL32.dll	751		InterlockedIncrement
KERNEL32.dll	747		InterlockedDecrement
KERNEL32.dll	1048		RtlUnwind
KERNEL32.dll	1135		SetHandleCount
KERNEL32.dll	739		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	611		GetStartupInfoW
KERNEL32.dll	209		DeleteCriticalSection
KERNEL32.dll	531		GetModuleFileNameA
KERNEL32.dll	353		FreeEnvironmentStringsW
KERNEL32.dll	474		GetEnvironmentStringsW
KERNEL32.dll	370		GetCPInfo
KERNEL32.dll	360		GetACP
KERNEL32.dll	567		GetOEMCP
KERNEL32.dll	778		IsValidCodePage
USER32.dll	533		MessageBoxW
USER32.dll	291		GetDesktopWindow
USER32.dll	360		GetProcessWindowStation
USER32.dll	394		GetUserObjectInformationA
USER32.dll	386		GetThreadDesktop
USER32.dll	395		GetUserObjectInformationW
ADVAPI32.dll	406		LookupPrivilegeValueA
ADVAPI32.dll	31		AdjustTokenPrivileges
ADVAPI32.dll	371		ImpersonateLoggedOnUser
ADVAPI32.dll	643		RegisterEventSourceW
ADVAPI32.dll	655		ReportEventW
ADVAPI32.dll	219		DeregisterEventSource
ADVAPI32.dll	508		OpenThreadToken
ADVAPI32.dll	503		OpenProcessToken

ord	entry_va	function_name
1	0x15dc	Init
2	0x213e	_ReflectiveLoader@0
3	0x5b621	buffer_from_file
4	0x5b6f3	buffer_to_file
5	0x623de	channel_close
6	0x62586	channel_create
7	0x6263e	channel_create_datagram
8	0x62684	channel_create_pool
9	0x625f8	channel_create_stream
10	0x6250e	channel_default_io_handler
11	0x62006	channel_destroy
12	0x61eca	channel_find_by_id
13	0x61dab	channel_get_buffered_io_context
14	0x61d58	channel_get_class
15	0x61d87	channel_get_flags
16	0x61d15	channel_get_id
17	0x61e9a	channel_get_native_io_context
18	0x61d4d	channel_get_type
19	0x6246f	channel_interact
20	0x61d71	channel_is_flag
21	0x61da0	channel_is_interactive
22	0x621fc	channel_open
23	0x6227a	channel_read
24	0x61e6b	channel_read_from_buffered
25	0x6256c	channel_set_buffered_io_handler
26	0x61d63	channel_set_flags
27	0x61d92	channel_set_interactive
28	0x61e8c	channel_set_native_io_context
29	0x61d1f	channel_set_type
30	0x62319	channel_write
31	0x61e4a	channel_write_to_buffered
32	0x61db6	channel_write_to_remote
33	0x5b90a	command_call_dispatch
34	0x5b7c0	command_deregister
35	0x5b82c	command_join_threads
36	0x5b95f	_command_process_thread@4
37	0x5b76a	command_register
38	0x5b859	command_validate_arguments
39	0x5a045	core_update_desktop
40	0x5a001	core_update_thread_token
41	0x5a4d3	packet_add_completion_handler
42	0x5aab5	packet_add_exception
43	0x5a96e	packet_add_tlv_bool
44	0x5a987	packet_add_tlv_group
45	0x5a92f	packet_add_tlv_qword
46	0x5a244	packet_add_tlv_raw
47	0x5a8ea	packet_add_tlv_string
48	0x5a90a	packet_add_tlv_uint
49	0x5aa44	packet_add_tlvs
50	0x5aede	packet_call_completion_handlers
51	0x5ad21	packet_create
52	0x5b1d7	packet_create_response
53	0x5a0bf	packet_destroy
54	0x5aa95	packet_enum_tlv
55	0x5aeca	packet_get_result
56	0x5ad87	packet_get_tlv
57	0x5aa75	packet_get_tlv_group_entry
58	0x5a31f	packet_get_tlv_meta
59	0x5ad9f	packet_get_tlv_string
60	0x5aea0	packet_get_tlv_value_bool
61	0x5ae43	packet_get_tlv_value_qword
62	0x5ae20	packet_get_tlv_value_raw
63	0x5adc6	packet_get_tlv_value_string
64	0x5aded	packet_get_tlv_value_uint
65	0x5a30e	packet_get_type
66	0x5a2ed	packet_is_tlv_null_terminated
67	0x5ab36	packet_receive
68	0x5a8e1	packet_receive_via_http
69	0x5a52c	packet_remove_completion_handler
70	0x5b254	packet_transmit
71	0x5b28e	packet_transmit_empty_response
72	0x5b0c3	packet_transmit_via_http
73	0x5a57e	packet_transmit_via_http_wininet
74	0x5af68	packet_transmit_via_ssl
75	0x5bf82	scheduler_destroy
76	0x5bf59	scheduler_initialize
77	0x5c173	scheduler_insert_waitable
78	0x5c01f	scheduler_remove_waitable
79	0x5c098	_scheduler_waitable_thread@4
80	0x5b2c5	send_core_console_write

module_name	metsrv.dll
flags	0
timestamp	2012-09-11 19:09:43
version	0.0
ordinal_base	1
nFunctions	80
nNames	80
Names(80)	0x9ca28
Functions(80)	0x9c8e8
NameOrdinals(80)	0x9cb68

show previews

offset	size	type	comment
0	752128	DLL	09/11/2012 19:09:43	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK