filenamesysprep.exe
size128512 (0x1f600)
md510a7673fcdfcc67dccb9c03d1b2152d5
typePE32+ executable (GUI) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
149307292
132307293
1473072929
10226
1313072919
1383072932
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections5
TimeDateStamp0x4a5bc35b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion9.0
SizeOfCode0x18400
SizeOfInitializedData0x7800
SizeOfUninitializedData0
AddressOfEntryPoint0x16ce0
BaseOfCode0x1000
ImageBase0x100000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x24000
SizeOfHeaders0x400
CheckSum0x2a6a6
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x80000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

namevavsizeraw sizeflags
.text0x10000x182e40x18400R-X CODE
.data0x1a0000xaf80x200RW- IDATA
.pdata0x1b0000x75c0x800R-- IDATA
.rsrc0x1c0000x60180x6200R-- IDATA
.reloc0x230000x1ba0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x17ef80x12c
RESOURCE0x1c0000x6018
EXCEPTION0x1b0000x75c
SECURITY00
BASERELOC0x230000x48
DEBUG0x16100x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2b00x13c
IAT0x10000x5b8
Delay_IAT00
CLR_Header00
typenamesizecp
AVI#2011163840
MUI#12560
WEVT_TEMPLATE#117380
ICON#17440
ICON#222160
ICON#32960
GROUP_ICONIDI_MAIN480
VERSION#19160
MANIFEST#113040
module_namehintordfunction_name
ADVAPI32.dll347GetTraceEnableFlags
ADVAPI32.dll349GetTraceLoggerHandle
ADVAPI32.dll770UnregisterTraceGuids
ADVAPI32.dll348GetTraceEnableLevel
ADVAPI32.dll650RegisterTraceGuidsW
ADVAPI32.dll381InitiateSystemShutdownExW
ADVAPI32.dll715StartTraceW
ADVAPI32.dll635RegSetKeyValueW
ADVAPI32.dll245EnableTrace
ADVAPI32.dll96ControlTraceW
ADVAPI32.dll756TraceEvent
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll595RegFlushKey
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll580RegDeleteKeyW
ADVAPI32.dll616RegQueryInfoKeyW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll592RegEnumKeyW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll503OpenProcessToken
KERNEL32.dll1338WritePrivateProfileStringW
KERNEL32.dll210DeleteCriticalSection
KERNEL32.dll746InitializeCriticalSection
KERNEL32.dll1021ReleaseMutex
KERNEL32.dll832LoadLibraryExW
KERNEL32.dll486GetExitCodeProcess
KERNEL32.dll158CreateMutexW
KERNEL32.dll1135SetFileAttributesW
KERNEL32.dll1312WideCharToMultiByte
KERNEL32.dll168CreateProcessW
KERNEL32.dll225DeviceIoControl
KERNEL32.dll454GetCurrentProcess
KERNEL32.dll1030RemoveDirectoryW
KERNEL32.dll349FlushFileBuffers
KERNEL32.dll143CreateFileW
KERNEL32.dll497GetFileAttributesW
KERNEL32.dll117CopyFileW
KERNEL32.dll114CopyFileExW
KERNEL32.dll291ExpandEnvironmentStringsW
KERNEL32.dll1377lstrlenW
KERNEL32.dll833LoadLibraryW
KERNEL32.dll360FreeLibrary
KERNEL32.dll1126SetErrorMode
KERNEL32.dll397GetCommandLineW
KERNEL32.dll538GetModuleFileNameW
KERNEL32.dll129CreateDirectoryW
KERNEL32.dll723HeapAlloc
KERNEL32.dll514GetFullPathNameW
KERNEL32.dll331FindNextFileW
KERNEL32.dll308FindClose
KERNEL32.dll1152SetLastError
KERNEL32.dll453GetCurrentDirectoryW
KERNEL32.dll100CompareStringW
KERNEL32.dll319FindFirstFileW
KERNEL32.dll1250UnhandledExceptionFilter
KERNEL32.dll1230TerminateProcess
KERNEL32.dll640GetSystemTimeAsFileTime
KERNEL32.dll455GetCurrentProcessId
KERNEL32.dll459GetCurrentThreadId
KERNEL32.dll666GetTickCount
KERNEL32.dll937QueryPerformanceCounter
KERNEL32.dll1203SetUnhandledExceptionFilter
KERNEL32.dll618GetStartupInfoW
KERNEL32.dll727HeapFree
KERNEL32.dll1288WaitForSingleObject
KERNEL32.dll1127SetEvent
KERNEL32.dll1184SetThreadExecutionState
KERNEL32.dll542GetModuleHandleW
KERNEL32.dll593GetProcessHeap
KERNEL32.dll180CreateThread
KERNEL32.dll842LocalFree
KERNEL32.dll82CloseHandle
KERNEL32.dll133CreateEventW
KERNEL32.dll521GetLocalTime
KERNEL32.dll588GetProcAddress
KERNEL32.dll520GetLastError
KERNEL32.dll684GetVersionExW
KERNEL32.dll356FormatMessageW
KERNEL32.dll1216Sleep
USER32.dll218EndDialog
USER32.dll297GetDlgItem
USER32.dll175DispatchMessageW
USER32.dll537MessageBoxW
USER32.dll510LoadStringW
USER32.dll52CharPrevW
USER32.dll756SystemParametersInfoW
USER32.dll49CharNextW
USER32.dll166DestroyWindow
USER32.dll544MsgWaitForMultipleObjects
USER32.dll216EnableWindow
USER32.dll172DialogBoxParamW
USER32.dll745ShutdownBlockReasonCreate
USER32.dll772TranslateMessage
USER32.dll567PeekMessageW
USER32.dll746ShutdownBlockReasonDestroy
USER32.dll743ShowWindow
USER32.dll466IsDlgButtonChecked
USER32.dll99CreateDialogParamW
USER32.dll715SetWindowLongPtrW
USER32.dll640SendMessageW
msvcrt.dll128__set_app_type
msvcrt.dll280_fmode
msvcrt.dll196_commode
msvcrt.dll130__setusermatherr
msvcrt.dll160_amsg_exit
msvcrt.dll816_unlock
msvcrt.dll148_acmdln
msvcrt.dll1056exit
msvcrt.dll179_cexit
msvcrt.dll392_ismbblead
msvcrt.dll255_exit
msvcrt.dll82_XcptFilter
msvcrt.dll109__dllonexit
msvcrt.dll469_lock
msvcrt.dll48void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll364_initterm
msvcrt.dll113__getmainargs
msvcrt.dll1278wcsrchr
msvcrt.dll1263wcschr
msvcrt.dll899_wcsnicmp
msvcrt.dll856_vsnwprintf
msvcrt.dll847_vscwprintf
msvcrt.dll850_vsnprintf
msvcrt.dll83__C_specific_handler
msvcrt.dll639_onexit
msvcrt.dll1156memset
ole32.dll20CoCreateInstance
ole32.dll66CoInitialize
ole32.dll108CoTaskMemFree
ntdll.dll635RtlCaptureContext
ntdll.dll1025RtlLookupFunctionEntry
ntdll.dll1264RtlVirtualUnwind
ntdll.dll842RtlFreeHeap
ntdll.dll613RtlAllocateHeap
ntdll.dll494NtSetInformationFile
ntdll.dll1044RtlNtStatusToDosError
ActionQueue.dll1ProcessActionQueue
ActionQueue.dllGenerateActionQueue
RPCRT4.dll520UuidFromStringW
UNATTEND.DLL61UnattendFreeResults
UNATTEND.DLL42UnattendCtxReplaceMatchedNodesWithText
UNATTEND.DLL60UnattendFreeNode
UNATTEND.DLL5UnattendCtxBeginModify
UNATTEND.DLL70UnattendMarkPassUsedInCtx
UNATTEND.DLL6UnattendCtxCancelModify
UNATTEND.DLL37UnattendCtxOpenNode
UNATTEND.DLL14UnattendCtxDeserializeWithResults
UNATTEND.DLL2UnattendAddResults
UNATTEND.DLL8UnattendCtxCommitModify
UNATTEND.DLL7UnattendCtxCleanup
UNATTEND.DLL44UnattendCtxSerialize
UNATTEND.DLL45UnattendCtxSerializeSettingsStream
UNATTEND.DLL57UnattendFindAnswerFileWithResults
OLEAUT32.dll6
WDSCORE.dll69ConstructPartialMsgVW
WDSCORE.dll117WdsInitialize
WDSCORE.dll151WdsSetupLogMessageW
WDSCORE.dll153WdsTerminate
WDSCORE.dll70CurrentIP
SHLWAPI.dll139PathRemoveFileSpecW
SETUPAPI.dll641pSetupIsUserAdmin
SETUPAPI.dll618pSetupDoesUserHavePrivilege
COMCTL32.dll124InitCommonControlsEx

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionSystem Preparation Tool
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamesysprep.EXE
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamesysprep.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
1b11816216AVI#
1f0701424BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2b0