filenamecisvc.exe
size5632 (0x1600)
md54ede5d321d299c5d8c0212ba5df4da40
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1540353
95403513
9340359
1030
9440351
9640354
9040351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x48025460
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x11f
Magic0x10b
LinkerVersion7.10
SizeOfCode0xc00
SizeOfInitializedData0x600
SizeOfUninitializedData0
AddressOfEntryPoint0x1a28
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion5.0
Reserved10
SizeOfImage0x4000
SizeOfHeaders0x400
CheckSum0x3278
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Armadillo v4.x

Sections

namevavsizeraw sizeflags
.text0x10000xa280xc00R-X CODE
.data0x20000x580x200RW- IDATA
.rsrc0x30000x3e00x400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x16f40x64
RESOURCE0x30000x3e0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x10900x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x11080x40
Bound_IAT0x2500x58
IAT0x10000x7c
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#18920
module_namehintordfunction_name
query.dll34public: __thiscall CException::CException(void)

??0CException@@QAE@XZ

query.dll792CiSvcMain
query.dll724void __cdecl SystemExceptionTranslator(unsigned int, struct _EXCEPTION_POINTERS *)

?SystemExceptionTranslator@@YAXIPAU_EXCEPTION_POINTERS@@@Z

msvcrt.dll45void (__cdecl*__cdecl _set_se_translator(void (__cdecl*)(unsigned int, struct _EXCEPTION_POINTERS *)))(unsigned int, struct _EXCEPTION_POINTERS *)

?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z

msvcrt.dll82__CxxFrameHandler
msvcrt.dll71_CxxThrowException
msvcrt.dll197_c_exit
msvcrt.dll246_exit
msvcrt.dll78_XcptFilter
msvcrt.dll200_cexit
msvcrt.dll656exit
msvcrt.dll165__winitenv
msvcrt.dll164__wgetmainargs
msvcrt.dll315_initterm
msvcrt.dll154__setusermatherr
msvcrt.dll182_adjust_fdiv
msvcrt.dll128__p__commode
msvcrt.dll133__p__fmode
msvcrt.dll152__set_app_type
msvcrt.dll237_except_handler3
msvcrt.dll18void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll16public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll214_controlfp
msvcrt.dll52void __cdecl terminate(void)

?terminate@@YAXXZ

ADVAPI32.dll578StartServiceCtrlDispatcherW
KERNEL32.dll771SetErrorMode
KERNEL32.dll374GetModuleHandleA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionContent Index service
FileVersion5.1.2600.5512 (xpsp.080413-0852)
InternalNamecisvc.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamecisvc.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.1.2600.5512

VS_FIXEDFILEINFO

FileVersion5.1.2600.5512
ProductVersion5.1.2600.5512
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
05632EXE04/13/2008 18:43:44#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x250