T4YI2

info
MZ
PE
imports
exports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	T4YI2
size	959043 (0xea243)
md5	fd5a409fb910895426ed1e8f01058965

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0xe8
blocks_in_file	0
num_relocs	0x5b00
header_paragraphs	0x4552
min_extra_paragraphs	0x8955
max_extra_paragraphs	0x81e5
ss	0x62c3
sp	0x17
checksum	0xff00
ip	0x81d3
cs	0x97c3
reloc_table_offset	0xe82
overlay_number	0x8900
reserved0	0xd0ff50046a533b
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x572f44cd
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	12.0
SizeOfCode	0x9ea00
SizeOfInitializedData	0x50400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x884fa
BaseOfCode	0x1000
BaseOfData	0xa0000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xf1000
SizeOfHeaders	0x400
CheckSum	0xf8c76
Subsystem	2
DllCharacteristics	0x100
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x9e83a	0x9ea00	R-X CODE
.rdata	0xa0000	0x2dc52	0x2de00	R-- IDATA
.data	0xce000	0x189ec	0x13200	RW- IDATA
.reloc	0xe7000	0x9b88	0x9c00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0xcc250	0x9cb
IMPORT	0xccc1c	0xa0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xe7000	0x9b88
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xcbad0	0x40
Bound_IAT	0	0
IAT	0xa0000	0x300
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
WS2_32.dll		22
WS2_32.dll		19
WS2_32.dll		14
WS2_32.dll		4
WS2_32.dll		8
WS2_32.dll		9
WS2_32.dll		11
WS2_32.dll		12
WS2_32.dll		13
WS2_32.dll		111
WS2_32.dll		112
WS2_32.dll		115
WS2_32.dll		55
WS2_32.dll		56
WS2_32.dll		52
WS2_32.dll		51
WS2_32.dll		23
WS2_32.dll		21
WS2_32.dll		18
WS2_32.dll		16
WS2_32.dll		15
WS2_32.dll	33		WSADuplicateSocketA
WS2_32.dll		3
WS2_32.dll		2
WS2_32.dll		1
CRYPT32.dll	70		CertGetCertificateContextProperty
WININET.dll	154		InternetOpenW
WININET.dll	107		InternetCloseHandle
WININET.dll	114		InternetConnectW
WININET.dll	159		InternetReadFile
WININET.dll	175		InternetSetOptionW
WININET.dll	88		HttpOpenRequestW
WININET.dll	94		HttpSendRequestW
WININET.dll	90		HttpQueryInfoW
WININET.dll	116		InternetCrackUrlW
WINHTTP.dll	20		WinHttpQueryOption
WINHTTP.dll	23		WinHttpSendRequest
WINHTTP.dll	21		WinHttpReadData
WINHTTP.dll	8		WinHttpConnect
WINHTTP.dll	15		WinHttpOpen
WINHTTP.dll	9		WinHttpCrackUrl
WINHTTP.dll	16		WinHttpOpenRequest
WINHTTP.dll	26		WinHttpSetOption
WINHTTP.dll	7		WinHttpCloseHandle
WINHTTP.dll	13		WinHttpGetIEProxyConfigForCurrentUser
WINHTTP.dll	14		WinHttpGetProxyForUrl
WINHTTP.dll	19		WinHttpQueryHeaders
WINHTTP.dll	22		WinHttpReceiveResponse
KERNEL32.dll	100		CompareStringW
KERNEL32.dll	617		GetStringTypeW
KERNEL32.dll	945		RaiseException
KERNEL32.dll	143		CreateFileW
KERNEL32.dll	830		LoadLibraryExW
KERNEL32.dll	906		OutputDebugStringW
KERNEL32.dll	293		FileTimeToSystemTime
KERNEL32.dll	1214		SystemTimeToTzSpecificLocalTime
KERNEL32.dll	467		GetDriveTypeW
KERNEL32.dll	308		FindFirstFileExW
KERNEL32.dll	1159		SetStdHandle
KERNEL32.dll	1127		SetFilePointerEx
KERNEL32.dll	958		ReadConsoleW
KERNEL32.dll	410		GetConsoleCP
KERNEL32.dll	343		FlushFileBuffers
KERNEL32.dll	1222		TlsFree
KERNEL32.dll	1224		TlsSetValue
KERNEL32.dll	1223		TlsGetValue
KERNEL32.dll	1221		TlsAlloc
KERNEL32.dll	581		GetProcAddress
KERNEL32.dll	344		FlushInstructionCache
KERNEL32.dll	1257		VirtualAlloc
KERNEL32.dll	1260		VirtualFree
KERNEL32.dll	1263		VirtualProtect
KERNEL32.dll	1265		VirtualQuery
KERNEL32.dll	1326		WriteProcessMemory
KERNEL32.dll	813		LCMapStringW
KERNEL32.dll	831		LoadLibraryW
KERNEL32.dll	533		GetModuleHandleA
KERNEL32.dll	281		ExitProcess
KERNEL32.dll	1189		SetUnhandledExceptionFilter
KERNEL32.dll	282		ExitThread
KERNEL32.dll	514		GetLastError
KERNEL32.dll	624		GetSystemDirectoryW
KERNEL32.dll	679		GetVolumeInformationW
KERNEL32.dll	399		GetComputerNameW
KERNEL32.dll	354		FreeLibrary
KERNEL32.dll	448		GetCurrentProcess
KERNEL32.dll	449		GetCurrentProcessId
KERNEL32.dll	453		GetCurrentThreadId
KERNEL32.dll	1139		SetLastError
KERNEL32.dll	536		GetModuleHandleW
KERNEL32.dll	1136		SetHandleInformation
KERNEL32.dll	623		GetSystemDirectoryA
KERNEL32.dll	698		GlobalFree
KERNEL32.dll	1202		Sleep
KERNEL32.dll	612		GetStdHandle
KERNEL32.dll	499		GetFileType
KERNEL32.dll	302		FindClose
KERNEL32.dll	82		CloseHandle
KERNEL32.dll	935		QueryPerformanceCounter
KERNEL32.dll	659		GetTickCount
KERNEL32.dll	703		GlobalMemoryStatus
KERNEL32.dll	342		FlushConsoleInputBuffer
KERNEL32.dll	1216		TerminateProcess
KERNEL32.dll	739		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1235		UnhandledExceptionFilter
KERNEL32.dll	353		FreeEnvironmentStringsW
KERNEL32.dll	474		GetEnvironmentStringsW
KERNEL32.dll	1110		SetEnvironmentVariableA
KERNEL32.dll	292		FileTimeToLocalFileTime
KERNEL32.dll	492		GetFileInformationByHandle
KERNEL32.dll	909		PeekNamedPipe
KERNEL32.dll	507		GetFullPathNameW
KERNEL32.dll	447		GetCurrentDirectoryW
KERNEL32.dll	724		HeapSize
KERNEL32.dll	1107		SetEndOfFile
KERNEL32.dll	828		LoadLibraryA
KERNEL32.dll	1317		WriteFile
KERNEL32.dll	531		GetModuleFileNameA
KERNEL32.dll	611		GetStartupInfoW
KERNEL32.dll	209		DeleteCriticalSection
KERNEL32.dll	370		GetCPInfo
KERNEL32.dll	567		GetOEMCP
KERNEL32.dll	360		GetACP
KERNEL32.dll	778		IsValidCodePage
KERNEL32.dll	1048		RtlUnwind
KERNEL32.dll	496		GetFileSize
KERNEL32.dll	960		ReadFile
KERNEL32.dll	136		CreateFileA
KERNEL32.dll	181		CreateThread
KERNEL32.dll	1217		TerminateThread
KERNEL32.dll	1043		ResumeThread
KERNEL32.dll	1113		SetEvent
KERNEL32.dll	1018		ReleaseMutex
KERNEL32.dll	1273		WaitForSingleObject
KERNEL32.dll	155		CreateMutexA
KERNEL32.dll	130		CreateEventA
KERNEL32.dll	1271		WaitForMultipleObjects
KERNEL32.dll	631		GetSystemTime
KERNEL32.dll	1213		SystemTimeToFileTime
KERNEL32.dll	1258		VirtualAllocEx
KERNEL32.dll	896		OpenProcess
KERNEL32.dll	232		DuplicateHandle
KERNEL32.dll	1266		VirtualQueryEx
KERNEL32.dll	901		OpenThread
KERNEL32.dll	1210		SuspendThread
KERNEL32.dll	675		GetVersionExA
KERNEL32.dll	190		CreateToolhelp32Snapshot
KERNEL32.dll	1219		Thread32First
KERNEL32.dll	1220		Thread32Next
KERNEL32.dll	169		CreateRemoteThread
KERNEL32.dll	650		GetThreadId
KERNEL32.dll	719		HeapFree
KERNEL32.dll	715		HeapAlloc
KERNEL32.dll	722		HeapReAlloc
KERNEL32.dll	633		GetSystemTimeAsFileTime
KERNEL32.dll	1297		WideCharToMultiByte
KERNEL32.dll	390		GetCommandLineA
KERNEL32.dll	772		IsProcessorFeaturePresent
KERNEL32.dll	238		EnterCriticalSection
KERNEL32.dll	825		LeaveCriticalSection
KERNEL32.dll	664		GetTimeZoneInformation
KERNEL32.dll	768		IsDebuggerPresent
KERNEL32.dll	532		GetModuleFileNameW
KERNEL32.dll	535		GetModuleHandleExW
KERNEL32.dll	1316		WriteConsoleW
KERNEL32.dll	1069		SetConsoleCtrlHandler
KERNEL32.dll	428		GetConsoleMode
KERNEL32.dll	949		ReadConsoleInputA
KERNEL32.dll	1085		SetConsoleMode
KERNEL32.dll	871		MultiByteToWideChar
KERNEL32.dll	586		GetProcessHeap
KERNEL32.dll	21		AreFileApisANSI
USER32.dll	386		GetThreadDesktop
USER32.dll	395		GetUserObjectInformationW
USER32.dll	526		MessageBoxA
USER32.dll	291		GetDesktopWindow
USER32.dll	360		GetProcessWindowStation
ADVAPI32.dll	31		AdjustTokenPrivileges
ADVAPI32.dll	371		ImpersonateLoggedOnUser
ADVAPI32.dll	406		LookupPrivilegeValueA
ADVAPI32.dll	654		ReportEventA
ADVAPI32.dll	642		RegisterEventSourceA
ADVAPI32.dll	219		DeregisterEventSource
ADVAPI32.dll	508		OpenThreadToken
ADVAPI32.dll	503		OpenProcessToken

ord	entry_va	function_name
1	0x1ae2	Init
2	0x2369	_ReflectiveLoader@0
3	0x7b835	buffer_from_file
4	0x7b907	buffer_to_file
5	0x841a0	channel_close
6	0x83ba8	channel_create
7	0x83c60	channel_create_datagram
8	0x83ca6	channel_create_pool
9	0x83c1a	channel_create_stream
10	0x83f1c	channel_default_io_handler
11	0x83cea	channel_destroy
12	0x84310	channel_find_by_id
13	0x83ef8	channel_get_buffered_io_context
14	0x83d99	channel_get_class
15	0x83dc8	channel_get_flags
16	0x83d55	channel_get_id
17	0x83f11	channel_get_native_io_context
18	0x83d8e	channel_get_type
19	0x84251	channel_interact
20	0x83db2	channel_is_flag
21	0x83de1	channel_is_interactive
22	0x83f59	channel_open
23	0x83ff0	channel_read
24	0x83ebd	channel_read_from_buffered
25	0x83ede	channel_set_buffered_io_handler
26	0x83da4	channel_set_flags
27	0x83dd3	channel_set_interactive
28	0x83f03	channel_set_native_io_context
29	0x83d5f	channel_set_type
30	0x840af	channel_write
31	0x83e9c	channel_write_to_buffered
32	0x83dec	channel_write_to_remote
33	0x7c9df	command_deregister
34	0x7c960	command_deregister_all
35	0x7ca78	command_handle
36	0x7ca4b	command_join_threads
37	0x7c989	command_register
38	0x7c937	command_register_all
39	0x7c5ee	core_update_desktop
40	0x7c5aa	core_update_thread_token
41	0x7c46e	packet_add_completion_handler
42	0x7c380	packet_add_exception
43	0x7bea4	packet_add_group
44	0x7bfb7	packet_add_tlv_bool
45	0x7bfd0	packet_add_tlv_group
46	0x7bf7e	packet_add_tlv_qword
47	0x7c0bd	packet_add_tlv_raw
48	0x7becf	packet_add_tlv_string
49	0x7bf59	packet_add_tlv_uint
50	0x7beef	packet_add_tlv_wstring
51	0x7bf0e	packet_add_tlv_wstring_len
52	0x7c08c	packet_add_tlvs
53	0x7c4c8	packet_call_completion_handlers
54	0x7bcf6	packet_create
55	0x7bde6	packet_create_group
56	0x7bd5d	packet_create_response
57	0x7be19	packet_destroy
58	0x7c20d	packet_enum_tlv
59	0x7c1b2	packet_get_tlv
60	0x7c1ed	packet_get_tlv_group_entry
61	0x7c1a2	packet_get_tlv_meta
62	0x7c1ca	packet_get_tlv_string
63	0x7c354	packet_get_tlv_value_bool
64	0x7c2fb	packet_get_tlv_value_qword
65	0x7c2d3	packet_get_tlv_value_raw
66	0x7c22d	packet_get_tlv_value_string
67	0x7c29e	packet_get_tlv_value_uint
68	0x7c255	packet_get_tlv_value_wstring
69	0x7c191	packet_get_type
70	0x7c170	packet_is_tlv_null_terminated
71	0x7c558	packet_remove_completion_handler
72	0x7c448	packet_transmit_empty_response
73	0x7c403	packet_transmit_response
74	0x7d2c1	scheduler_destroy
75	0x7d298	scheduler_initialize
76	0x7d382	scheduler_insert_waitable
77	0x7d403	scheduler_signal_waitable
78	0x7d4c0	_scheduler_waitable_thread@4

module_name	metsrv.dll
flags	0
timestamp	2016-05-08 13:53:17
version	0.0
ordinal_base	1
nFunctions	78
nNames	78
Names(78)	0xcc3b0
Functions(78)	0xcc278
NameOrdinals(78)	0xcc4e8

show previews

offset	size	type	comment
0	956928	DLL	05/08/2016 13:53:17	#
15c1	15	HTM		#
e9a00	2115	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 959043 bytes (937 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid DOS stub size -283688