filenamealg.exe
size44544 (0xae00)
md51f559252e6d787b9b48463bb2c8ceac2
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1540353
10105
93403517
95403517
9440351
96403524
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x480256a1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x8a00
SizeOfInitializedData0x2200
SizeOfUninitializedData0
AddressOfEntryPoint0x5bc6
BaseOfCode0x1000
BaseOfData0xa000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0xd000
SizeOfHeaders0x400
CheckSum0xc901
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.1 EXE / v7.0

Sections

namevavsizeraw sizeflags
.text0x10000x88060x8a00R-X CODE
.data0xa0000x3200x200RW- IDATA
.rsrc0xb0000x1c080x1e00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x8f700xb4
RESOURCE0xb0000x1c08
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x11c00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x17400x40
Bound_IAT0x2580xd4
IAT0x10000x1c0
Delay_IAT00
CLR_Header00
typenamesizecp
REGISTRY#1001690
REGISTRY#1016220
REGISTRY#1027570
REGISTRY#1037170
REGISTRY#1047020
REGISTRY#1056060
REGISTRY#1066940
REGISTRY#1076060
REGISTRY#1086860
STRING#7380
VERSION#19080
idlangstring
1001033ALG
module_namehintordfunction_name
msvcrt.dll182_adjust_fdiv
msvcrt.dll128__p__commode
msvcrt.dll133__p__fmode
msvcrt.dll735memmove
msvcrt.dll553_wcsicmp
msvcrt.dll154__setusermatherr
msvcrt.dll315_initterm
msvcrt.dll164__wgetmainargs
msvcrt.dll549_wcmdln
msvcrt.dll656exit
msvcrt.dll200_cexit
msvcrt.dll78_XcptFilter
msvcrt.dll246_exit
msvcrt.dll197_c_exit
msvcrt.dll449_purecall
msvcrt.dll82__CxxFrameHandler
msvcrt.dll17void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll152__set_app_type
msvcrt.dll237_except_handler3
msvcrt.dll106__dllonexit
msvcrt.dll436_onexit
msvcrt.dll214_controlfp
msvcrt.dll698isdigit
msvcrt.dll18void __cdecl operator delete(void *)

??3@YAXPAX@Z

ATL.DLL21
ATL.DLL32
ATL.DLL20
ATL.DLL17
ATL.DLL23
ATL.DLL16
ADVAPI32.dll485RegOpenKeyExW
ADVAPI32.dll473RegEnumKeyExW
ADVAPI32.dll495RegQueryValueExW
ADVAPI32.dll578StartServiceCtrlDispatcherW
ADVAPI32.dll481RegNotifyChangeKeyValue
ADVAPI32.dll518RegisterServiceCtrlHandlerW
ADVAPI32.dll571SetServiceStatus
ADVAPI32.dll458RegCloseKey
ADVAPI32.dll620SystemFunction036
KERNEL32.dll431GetStartupInfoW
KERNEL32.dll374GetModuleHandleA
KERNEL32.dll108CreateThread
KERNEL32.dll859UnhandledExceptionFilter
KERNEL32.dll842TerminateProcess
KERNEL32.dll448GetSystemTimeAsFileTime
KERNEL32.dll110CreateTimerQueueTimer
KERNEL32.dll678ReadFile
KERNEL32.dll316GetCurrentProcessId
KERNEL32.dll911WriteFile
KERNEL32.dll31BindIoCompletionCallback
KERNEL32.dll864UnregisterWait
KERNEL32.dll686RegisterWaitForSingleObject
KERNEL32.dll517HeapAlloc
KERNEL32.dll133DeleteTimerQueueTimer
KERNEL32.dll412GetProcessHeap
KERNEL32.dll523HeapFree
KERNEL32.dll145DuplicateHandle
KERNEL32.dll315GetCurrentProcess
KERNEL32.dll660QueryPerformanceCounter
KERNEL32.dll468GetTickCount
KERNEL32.dll822SetUnhandledExceptionFilter
KERNEL32.dll150EnterCriticalSection
KERNEL32.dll579LeaveCriticalSection
KERNEL32.dll536InitializeCriticalSection
KERNEL32.dll360GetLastError
KERNEL32.dll109CreateTimerQueue
KERNEL32.dll127DeleteCriticalSection
KERNEL32.dll544InterlockedIncrement
KERNEL32.dll540InterlockedDecrement
KERNEL32.dll132DeleteTimerQueueEx
KERNEL32.dll49CloseHandle
KERNEL32.dll834Sleep
KERNEL32.dll892WaitForMultipleObjects
KERNEL32.dll76CreateEventW
KERNEL32.dll894WaitForSingleObject
KERNEL32.dll772SetEvent
KERNEL32.dll318GetCurrentThreadId
ole32.dll16CoCreateInstance
ole32.dll100CoTaskMemFree
ole32.dll99CoTaskMemAlloc
ole32.dll104CoUninitialize
ole32.dll59CoInitializeEx
ole32.dll8CLSIDFromString
OLEAUT32.dll6
OLEAUT32.dll2
WSOCK32.dll5
WSOCK32.dll6
WSOCK32.dll1142
WSOCK32.dll115
WSOCK32.dll21
WSOCK32.dll116
WSOCK32.dll9
WSOCK32.dll13
WSOCK32.dll3
WSOCK32.dll10
WSOCK32.dll111
WSOCK32.dll8
WSOCK32.dll1141
WSOCK32.dll2
WSOCK32.dll15
WS2_32.dll25WSAEnumNetworkEvents
WS2_32.dll19WSAConnect
WS2_32.dll28WSAEventSelect
WS2_32.dll66WSASocketW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionApplication Layer Gateway Service
FileVersion5.1.2600.5512 (xpsp.080413-0852)
InternalNameALG.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameALG.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.1.2600.5512

VS_FIXEDFILEINFO

FileVersion5.1.2600.5512
ProductVersion5.1.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
044544EXE04/13/2008 18:53:21#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x258