filenamealg.exe
size59392 (0xe800)
md518a54e132947cd98fea9accc57f98f13
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307291
1313072922
1473072917
10121
1323072931
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bc8e5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xb200
SizeOfInitializedData0x3600
SizeOfUninitializedData0
AddressOfEntryPoint0x7266
BaseOfCode0x1000
BaseOfData0xd000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x11000
SizeOfHeaders0x400
CheckSum0x17c9b
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xb05e0xb200R-X CODE
.data0xd0000x77c0x400RW- IDATA
.rsrc0xe0000x1fc00x2000R-- IDATA
.reloc0x100000xdce0xe00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xb6840xb4
RESOURCE0xe0000x1fc0
EXCEPTION00
SECURITY00
BASERELOC0x100000xb08
DEBUG0x12300x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x18900x40
Bound_IAT0x2800xcc
IAT0x10000x1fc
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12160
REGISTRY#1001690
REGISTRY#1016220
REGISTRY#1027570
REGISTRY#1037170
REGISTRY#1047020
REGISTRY#1056060
REGISTRY#1066940
REGISTRY#1076060
REGISTRY#1086860
VERSION#19200
MANIFEST#16870
module_namehintordfunction_name
ADVAPI32.dll704SetServiceStatus
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll648RegisterServiceCtrlHandlerW
ADVAPI32.dll605RegNotifyChangeKeyValue
ADVAPI32.dll712StartServiceCtrlDispatcherW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll753SystemFunction036
KERNEL32.dll217DeleteTimerQueueEx
KERNEL32.dll82CloseHandle
KERNEL32.dll1202Sleep
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll133CreateEventW
KERNEL32.dll723HeapSetInformation
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll1113SetEvent
KERNEL32.dll181CreateThread
KERNEL32.dll218DeleteTimerQueueTimer
KERNEL32.dll189CreateTimerQueueTimer
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll232DuplicateHandle
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll945RaiseException
KERNEL32.dll514GetLastError
KERNEL32.dll188CreateTimerQueue
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll748InterlockedExchange
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll57BindIoCompletionCallback
KERNEL32.dll1317WriteFile
KERNEL32.dll960ReadFile
KERNEL32.dll719HeapFree
KERNEL32.dll586GetProcessHeap
KERNEL32.dll715HeapAlloc
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1216TerminateProcess
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll533GetModuleHandleA
msvcrt.dll295_controlfp
msvcrt.dll747_onexit
msvcrt.dll578_lock
msvcrt.dll9public: __thiscall exception::exception(char const * const &)

??0exception@@QAE@ABQBD@Z

msvcrt.dll57public: virtual char const * __thiscall exception::what(void)const

?what@exception@@UBEPBDXZ

msvcrt.dll16public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

msvcrt.dll11public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

msvcrt.dll99_CxxThrowException
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll764_purecall
msvcrt.dll141__dllonexit
msvcrt.dll934_unlock
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll210__set_app_type
msvcrt.dll190__p__fmode
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll999_wcmdln
msvcrt.dll1167exit
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll225__wgetmainargs
msvcrt.dll1246malloc
msvcrt.dll274_callnewh
msvcrt.dll1279realloc
msvcrt.dll1260memmove
msvcrt.dll1262memset
msvcrt.dll12public: __thiscall exception::exception(void)

??0exception@@QAE@XZ

msvcrt.dll1216isdigit
msvcrt.dll1261memmove_s
msvcrt.dll1259memcpy_s
msvcrt.dll1007_wcsicmp
msvcrt.dll1190free
msvcrt.dll1258memcpy
msvcrt.dll345_except_handler4_common
ATL.DLL23
ATL.DLL21
ATL.DLL16
ATL.DLL17
ATL.DLL20
ATL.DLL32
WS2_32.dll13
WS2_32.dll83WSASocketW
WS2_32.dll21
WS2_32.dll115
WS2_32.dll116
WS2_32.dll9
WS2_32.dll6
WS2_32.dll23
WS2_32.dll2
WS2_32.dll5
WS2_32.dll54WSAIoctl
WS2_32.dll15
WS2_32.dll111
WS2_32.dll8
WS2_32.dll3
ole32.dll16CoCreateInstance
ole32.dll104CoTaskMemFree
ole32.dll103CoTaskMemAlloc
ole32.dll108CoUninitialize
ole32.dll63CoInitializeEx
ole32.dll8CLSIDFromString
OLEAUT32.dll2
OLEAUT32.dll6
WSOCK32.dll1141
WSOCK32.dll1142

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionApplication Layer Gateway Service
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNameALG.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameALG.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
059392EXE07/13/2009 23:53:09#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280