ServiceEXE

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	ServiceEXE
size	2721810 (0x298812)
md5	7d78078329a5093f6a6040472c7eff0f

type	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x503a2343
PointerToSymbolTable	0x209600
NumberOfSymbols	0x4a97
SizeOfOptionalHeader	0xe0
Characteristics	0x306
Magic	0x10b
LinkerVersion	2.20
SizeOfCode	0x1a3000
SizeOfInitializedData	0x209200
SizeOfUninitializedData	0xb200
AddressOfEntryPoint	0x1160
BaseOfCode	0x1000
BaseOfData	0x1a4000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x219000
SizeOfHeaders	0x400
CheckSum	0x2a4d5a
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1a2e14	0x1a3000	R-X CODE IDATA
.data	0x1a4000	0x10f58	0x11000	RW- IDATA
.rdata	0x1b5000	0x40dc0	0x40e00	R-- IDATA
.bss	0x1f6000	0xb0c8	0	RW- UDATA
.edata	0x202000	0x61e	0x800	R-- IDATA
.idata	0x203000	0x1e3c	0x2000	RW- IDATA
.CRT	0x205000	0x18	0x200	RW- IDATA
.tls	0x206000	0x20	0x200	RW- IDATA
.reloc	0x207000	0x116b4	0x11800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x202000	0x61e
IMPORT	0x203000	0x1e3c
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x207000	0x116b4
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x206000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x606019	0x60601c	0x600400	0x605004	0	0

module_name	hint	function_name
ADVAPI32.DLL	49	ChangeServiceConfig2A
ADVAPI32.DLL	58	CloseServiceHandle
ADVAPI32.DLL	61	ControlService
ADVAPI32.DLL	86	CreateProcessAsUserA
ADVAPI32.DLL	90	CreateServiceA
ADVAPI32.DLL	135	DeleteService
ADVAPI32.DLL	136	DeregisterEventSource
ADVAPI32.DLL	140	DuplicateTokenEx
ADVAPI32.DLL	358	OpenSCManagerA
ADVAPI32.DLL	360	OpenServiceA
ADVAPI32.DLL	380	QueryServiceStatusEx
ADVAPI32.DLL	386	RegCloseKey
ADVAPI32.DLL	390	RegCreateKeyExA
ADVAPI32.DLL	393	RegDeleteKeyA
ADVAPI32.DLL	413	RegOpenKeyExA
ADVAPI32.DLL	423	RegQueryValueExA
ADVAPI32.DLL	434	RegSetValueExA
ADVAPI32.DLL	439	RegisterEventSourceA
ADVAPI32.DLL	441	RegisterServiceCtrlHandlerA
ADVAPI32.DLL	449	ReportEventA
ADVAPI32.DLL	479	SetServiceStatus
ADVAPI32.DLL	484	StartServiceA
ADVAPI32.DLL	485	StartServiceCtrlDispatcherA
GDI32.dll	12	BitBlt
GDI32.dll	33	CreateCompatibleBitmap
GDI32.dll	34	CreateCompatibleDC
GDI32.dll	35	CreateDCA
GDI32.dll	70	DeleteDC
GDI32.dll	73	DeleteObject
GDI32.dll	119	GetBitmapBits
GDI32.dll	148	GetDeviceCaps
GDI32.dll	185	GetObjectA
GDI32.dll	281	SelectObject
IPHLPAPI.DLL	12	GetAdaptersInfo
KERNEL32.dll	3	AddAtomA
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	112	CopyFileA
KERNEL32.dll	129	CreateEventA
KERNEL32.dll	160	CreatePipe
KERNEL32.dll	163	CreateProcessA
KERNEL32.dll	169	CreateSemaphoreA
KERNEL32.dll	207	DeleteCriticalSection
KERNEL32.dll	230	DuplicateHandle
KERNEL32.dll	236	EnterCriticalSection
KERNEL32.dll	279	ExitProcess
KERNEL32.dll	282	ExpandEnvironmentStringsA
KERNEL32.dll	298	FindAtomA
KERNEL32.dll	300	FindClose
KERNEL32.dll	304	FindFirstFileA
KERNEL32.dll	321	FindNextFileA
KERNEL32.dll	347	FormatMessageA
KERNEL32.dll	352	FreeLibrary
KERNEL32.dll	363	GetAtomNameA
KERNEL32.dll	446	GetCurrentProcess
KERNEL32.dll	447	GetCurrentProcessId
KERNEL32.dll	450	GetCurrentThread
KERNEL32.dll	451	GetCurrentThreadId
KERNEL32.dll	473	GetEnvironmentVariableA
KERNEL32.dll	495	GetFileType
KERNEL32.dll	510	GetLastError
KERNEL32.dll	527	GetModuleFileNameA
KERNEL32.dll	577	GetProcAddress
KERNEL32.dll	578	GetProcessAffinityMask
KERNEL32.dll	608	GetStdHandle
KERNEL32.dll	629	GetSystemTimeAsFileTime
KERNEL32.dll	638	GetTempFileNameA
KERNEL32.dll	640	GetTempPathA
KERNEL32.dll	642	GetThreadContext
KERNEL32.dll	650	GetThreadPriority
KERNEL32.dll	656	GetTickCount
KERNEL32.dll	670	GetVersion
KERNEL32.dll	671	GetVersionExA
KERNEL32.dll	699	GlobalMemoryStatus
KERNEL32.dll	734	InitializeCriticalSection
KERNEL32.dll	743	InterlockedDecrement
KERNEL32.dll	744	InterlockedExchange
KERNEL32.dll	745	InterlockedExchangeAdd
KERNEL32.dll	747	InterlockedIncrement
KERNEL32.dll	763	IsDBCSLeadByteEx
KERNEL32.dll	814	LeaveCriticalSection
KERNEL32.dll	817	LoadLibraryA
KERNEL32.dll	860	MultiByteToWideChar
KERNEL32.dll	885	OpenProcess
KERNEL32.dll	896	PeekNamedPipe
KERNEL32.dll	922	QueryPerformanceCounter
KERNEL32.dll	947	ReadFile
KERNEL32.dll	978	ReleaseSemaphore
KERNEL32.dll	995	ResetEvent
KERNEL32.dll	999	ResumeThread
KERNEL32.dll	1065	SetEvent
KERNEL32.dll	1091	SetLastError
KERNEL32.dll	1121	SetThreadContext
KERNEL32.dll	1129	SetThreadPriority
KERNEL32.dll	1140	SetUnhandledExceptionFilter
KERNEL32.dll	1152	Sleep
KERNEL32.dll	1155	SleepEx
KERNEL32.dll	1160	SuspendThread
KERNEL32.dll	1166	TerminateProcess
KERNEL32.dll	1171	TlsAlloc
KERNEL32.dll	1172	TlsFree
KERNEL32.dll	1173	TlsGetValue
KERNEL32.dll	1174	TlsSetValue
KERNEL32.dll	1213	VirtualProtect
KERNEL32.dll	1215	VirtualQuery
KERNEL32.dll	1221	WaitForMultipleObjects
KERNEL32.dll	1223	WaitForSingleObject
KERNEL32.dll	1247	WideCharToMultiByte
KERNEL32.dll	1298	lstrcmpiA
msvcrt.dll	6	_close
msvcrt.dll	23	_fdopen
msvcrt.dll	38	_getpid
msvcrt.dll	58	_open
msvcrt.dll	64	_read
msvcrt.dll	78	_stat
msvcrt.dll	80	_strdup
msvcrt.dll	81	_stricmp
msvcrt.dll	84	_strnicmp
msvcrt.dll	97	_unlink
msvcrt.dll	109	_write
msvcrt.dll	55	__getmainargs
msvcrt.dll	61	__lc_codepage
msvcrt.dll	65	__mb_cur_max
msvcrt.dll	77	__p__environ
msvcrt.dll	79	__p__fmode
msvcrt.dll	99	__set_app_type
msvcrt.dll	137	_assert
msvcrt.dll	143	_beginthreadex
msvcrt.dll	147	_cexit
msvcrt.dll	154	_chmod
msvcrt.dll	169	_ctype
msvcrt.dll	179	_endthreadex
msvcrt.dll	182	_errno
msvcrt.dll	203	_filelengthi64
msvcrt.dll	222	_fstat
msvcrt.dll	224	_fstati64
msvcrt.dll	225	_ftime
msvcrt.dll	235	_getch
msvcrt.dll	245	_getpid
msvcrt.dll	266	_iob
msvcrt.dll	268	_isctype
msvcrt.dll	317	_lseeki64
msvcrt.dll	383	_onexit
msvcrt.dll	391	_pclose
msvcrt.dll	392	_pctype
msvcrt.dll	395	_popen
msvcrt.dll	403	_read
msvcrt.dll	422	_setjmp
msvcrt.dll	426	_setmode
msvcrt.dll	441	_spawnvpe
msvcrt.dll	443	_stat
msvcrt.dll	445	_stati64
msvcrt.dll	455	_strnicmp
msvcrt.dll	466	_sys_nerr
msvcrt.dll	475	_tzset
msvcrt.dll	483	_unlink
msvcrt.dll	490	_vsnprintf
msvcrt.dll	538	_winmajor
msvcrt.dll	583	abort
msvcrt.dll	590	atexit
msvcrt.dll	592	atoi
msvcrt.dll	595	calloc
msvcrt.dll	601	ctime
msvcrt.dll	604	exit
msvcrt.dll	607	fclose
msvcrt.dll	610	fflush
msvcrt.dll	612	fgetpos
msvcrt.dll	613	fgets
msvcrt.dll	618	fopen
msvcrt.dll	619	fprintf
msvcrt.dll	620	fputc
msvcrt.dll	621	fputs
msvcrt.dll	624	fread
msvcrt.dll	625	free
msvcrt.dll	629	fseek
msvcrt.dll	630	fsetpos
msvcrt.dll	631	ftell
msvcrt.dll	633	fwrite
msvcrt.dll	635	getc
msvcrt.dll	637	getenv
msvcrt.dll	641	gmtime
msvcrt.dll	671	localeconv
msvcrt.dll	672	localtime
msvcrt.dll	674	log10
msvcrt.dll	675	longjmp
msvcrt.dll	676	malloc
msvcrt.dll	680	memchr
msvcrt.dll	682	memcpy
msvcrt.dll	683	memmove
msvcrt.dll	684	memset
msvcrt.dll	689	printf
msvcrt.dll	690	putc
msvcrt.dll	692	puts
msvcrt.dll	695	qsort
msvcrt.dll	697	rand
msvcrt.dll	698	realloc
msvcrt.dll	700	rename
msvcrt.dll	704	setlocale
msvcrt.dll	705	setvbuf
msvcrt.dll	706	signal
msvcrt.dll	709	sprintf
msvcrt.dll	711	srand
msvcrt.dll	712	sscanf
msvcrt.dll	713	strcat
msvcrt.dll	714	strchr
msvcrt.dll	715	strcmp
msvcrt.dll	716	strcoll
msvcrt.dll	717	strcpy
msvcrt.dll	719	strerror
msvcrt.dll	720	strftime
msvcrt.dll	721	strlen
msvcrt.dll	723	strncmp
msvcrt.dll	724	strncpy
msvcrt.dll	726	strrchr
msvcrt.dll	728	strstr
msvcrt.dll	729	strtod
msvcrt.dll	731	strtol
msvcrt.dll	732	strtoul
msvcrt.dll	733	strxfrm
msvcrt.dll	739	time
msvcrt.dll	742	tolower
msvcrt.dll	743	toupper
msvcrt.dll	746	ungetc
msvcrt.dll	748	vfprintf
msvcrt.dll	761	wcslen
msvcrt.dll	768	wcsstr
PSAPI.DLL	18	GetProcessMemoryInfo
USER32.dll	250	GetDesktopWindow
USER32.dll	307	GetProcessWindowStation
USER32.dll	336	GetUserObjectInformationW
USER32.dll	434	MessageBoxA
wldap32.dll	10	ber_free
wldap32.dll	95	ldap_err2stringA
wldap32.dll	109	ldap_first_attributeA
wldap32.dll	111	ldap_first_entry
wldap32.dll	117	ldap_get_dnA
wldap32.dll	129	ldap_get_values_lenA
wldap32.dll	132	ldap_initA
wldap32.dll	135	ldap_memfreeA
wldap32.dll	161	ldap_msgfree
wldap32.dll	163	ldap_next_attributeA
wldap32.dll	165	ldap_next_entry
wldap32.dll	213	ldap_search_sA
wldap32.dll	221	ldap_set_optionA
wldap32.dll	227	ldap_simple_bind_sA
wldap32.dll	240	ldap_unbind_s
wldap32.dll	244	ldap_value_free_len
WS2_32.dll	25	WSACancelBlockingCall
WS2_32.dll	26	WSACleanup
WS2_32.dll	43	WSAGetLastError
WS2_32.dll	79	WSASetLastError
WS2_32.dll	84	WSAStartup
WS2_32.dll	131	__WSAFDIsSet
WS2_32.dll	132	accept
WS2_32.dll	133	bind
WS2_32.dll	134	closesocket
WS2_32.dll	135	connect
WS2_32.dll	139	gethostbyname
WS2_32.dll	140	gethostname
WS2_32.dll	145	getservbyname
WS2_32.dll	147	getsockname
WS2_32.dll	148	getsockopt
WS2_32.dll	149	htonl
WS2_32.dll	150	htons
WS2_32.dll	151	inet_addr
WS2_32.dll	155	ioctlsocket
WS2_32.dll	156	listen
WS2_32.dll	157	ntohl
WS2_32.dll	158	ntohs
WS2_32.dll	159	recv
WS2_32.dll	160	recvfrom
WS2_32.dll	161	select
WS2_32.dll	162	send
WS2_32.dll	163	sendto
WS2_32.dll	164	setsockopt
WS2_32.dll	165	shutdown
WS2_32.dll	166	socket

ord	entry_va	function_name
1	0x602a0	curl_easy_cleanup
2	0x60350	curl_easy_duphandle
3	0x86be0	curl_easy_escape
4	0x60320	curl_easy_getinfo
5	0x60130	curl_easy_init
6	0x60660	curl_easy_pause
7	0x601a0	curl_easy_perform
8	0x60840	curl_easy_recv
9	0x605b0	curl_easy_reset
10	0x608c0	curl_easy_send
11	0x60170	curl_easy_setopt
12	0x6f920	curl_easy_strerror
13	0x86d30	curl_easy_unescape
14	0x86d00	curl_escape
15	0x90250	curl_formadd
16	0x90d30	curl_formfree
17	0x917d0	curl_formget
18	0x86e90	curl_free
19	0x8a960	curl_getdate
20	0x87110	curl_getenv
21	0x600e0	curl_global_cleanup
22	0x5ff60	curl_global_init
23	0x60040	curl_global_init_mem
24	0x71770	curl_maprintf
25	0x71910	curl_mfprintf
26	0x718e0	curl_mprintf
27	0x70230	curl_msnprintf
28	0x718b0	curl_msprintf
29	0x6f6a0	curl_multi_add_handle
30	0x6f8d0	curl_multi_assign
31	0x6d750	curl_multi_cleanup
32	0x6d5c0	curl_multi_fdset
33	0x6d8d0	curl_multi_info_read
34	0x6d3f0	curl_multi_init
35	0x6ef30	curl_multi_perform
36	0x6f2e0	curl_multi_remove_handle
37	0x6dd20	curl_multi_setopt
38	0x6f290	curl_multi_socket
39	0x6f240	curl_multi_socket_action
40	0x6f1f0	curl_multi_socket_all
41	0x6fb40	curl_multi_strerror
42	0x6df00	curl_multi_timeout
43	0x71800	curl_mvaprintf
44	0x71990	curl_mvfprintf
45	0x71970	curl_mvprintf
46	0x71660	curl_mvsnprintf
47	0x71940	curl_mvsprintf
48	0x89f70	curl_share_cleanup
49	0x89e00	curl_share_init
50	0x89e30	curl_share_setopt
51	0x6fba0	curl_share_strerror
52	0x67b20	curl_slist_append
53	0x67b90	curl_slist_free_all
54	0x88100	curl_strequal
55	0x88130	curl_strnequal
56	0x86e60	curl_unescape

module_name	m_agent_service.exe
flags	0
timestamp	2012-08-26 13:23:15
version	0.0
ordinal_base	1
nFunctions	56
nNames	56
Names(56)	0x202108
Functions(56)	0x202028
NameOrdinals(56)	0x2021e8

show previews

offset	size	type	comment
0	2135552	EXE	08/26/2012 13:23:15	#
15c1	15	HTM		#
209600	586258	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x200400