filenameapimon.exe
size166912 (0x28c00)
md597511588b6bd6803943ede992681cfdf
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
6492104
10212
25921019
6991111
28917812
29917819
6192101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x3b7d8455
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.0
SizeOfCode0x14600
SizeOfInitializedData0x4e800
SizeOfUninitializedData0
AddressOfEntryPoint0x140b7
BaseOfCode0x1000
BaseOfData0x16000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x66000
SizeOfHeaders0x400
CheckSum0x28cff
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.x >> *SigBy Ahmed18

Sections

namevavsizeraw sizeflags
.text0x10000x145d40x14600R-X CODE
.data0x160000x4a3fc0xfe00RW- IDATA
.rsrc0x610000x42f00x4400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1445c0xc8
RESOURCE0x610000x42f0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x13a00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2580xd0
IAT0x10000x374
Delay_IAT00
CLR_Header00
typenamesizecp
CURSOR#33080
CURSOR#43080
BITMAP#40155920
BITMAP#4023520
ICON#17440
ICON#27440
MENUAPIMON6620
DIALOG#1013020
DIALOG#1029800
DIALOG#1031200
DIALOG#1043900
DIALOG#1056100
STRING#133880
STRING#192320
STRING#208460
STRING#214640
STRING#572000
STRING#3841920
STRING#38421000
STRING#3843940
STRING#3844960
STRING#38451040
STRING#38461120
STRING#3847660
STRING#38591000
STRING#38601600
ACCELERATORSAPIMON80
GROUP_CURSOR#801200
GROUP_CURSOR#802200
GROUP_ICON#501200
GROUP_ICON#502200
VERSION#18960
#241#401320
idlangstring
2011033API Monitor
2021033Move, size, or close application window
2031033Move, size, or close document window
2041033Create, open, save, or print documents
2051033Rearrange windows or activate specified window
2061033Get help
3011033Quits this application
3021033Arranges windows as non-overlapping tiles
3031033Arranges windows as overlapping tiles
3041033Arranges minimized window icons
3051033Displays information about this application
3071033Starts the Monitored Application
3081033Stops the Monitored Application
3101033Configure ApiMon Options
3111033Save ApiMon Options
3121033Opens program for monitoring
3131033Writes the captured data to the log file
3141033Changes the display font
3151033Changes the background color
3161033Opens a new DLL window
3171033Opens a new counter window
3181033Clears/Zeroes all API Counters
3191033Opens a new page fault window
3201033Arranges windows as non-overlapping tiles (Horizontally)
3211033Displays a bar graph for the captured data
3231033Refreshes the displayed data
3241033Remove the legend from the graph window
3251033Access help contents
3261033Opens the API trace view window
9011033Error %d
9021033Unable to allocate resources
9031033Pagefile is not large enough - try at least 150M
614401033Changes the size of the window
614561033Changes the position of the window
614721033Minimizes the window to an icon
614881033Enlarges the window to full size
615041033Switches to the next document window
615201033Switches to the previous document window
615361033Closes the window
617281033Restores the window to normal size
617441033Switches to another application through the Windows Task Manager
module_namehintordfunction_name
msvcrt.dll437_open_osfhandle
msvcrt.dll701isprint
msvcrt.dll643atoi
msvcrt.dll697isdigit
msvcrt.dll501_strdup
msvcrt.dll765strchr
msvcrt.dll687getchar
msvcrt.dll753scanf
msvcrt.dll773strncat
msvcrt.dll505_strlwr
msvcrt.dll726longjmp
msvcrt.dll774strncmp
msvcrt.dll475_setjmp3
msvcrt.dll351_itoa
msvcrt.dll197_c_exit
msvcrt.dll246_exit
msvcrt.dll78_XcptFilter
msvcrt.dll200_cexit
msvcrt.dll655exit
msvcrt.dll168_acmdln
msvcrt.dll109__getmainargs
msvcrt.dll314_initterm
msvcrt.dll154__setusermatherr
msvcrt.dll182_adjust_fdiv
msvcrt.dll250_fdopen
msvcrt.dll133__p__fmode
msvcrt.dll152__set_app_type
msvcrt.dll237_except_handler3
msvcrt.dll106__dllonexit
msvcrt.dll435_onexit
msvcrt.dll214_controlfp
msvcrt.dll743puts
msvcrt.dll775strncpy
msvcrt.dll746qsort
msvcrt.dll280_ftol
msvcrt.dll494_splitpath
msvcrt.dll683fwprintf
msvcrt.dll669fopen
msvcrt.dll658fclose
msvcrt.dll676free
msvcrt.dll727malloc
msvcrt.dll542_vsnprintf
msvcrt.dll503_stricmp
msvcrt.dll812wcslen
msvcrt.dll670fprintf
msvcrt.dll793tolower
msvcrt.dll760sprintf
msvcrt.dll17void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll18void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll318_iob
msvcrt.dll756setvbuf
msvcrt.dll128__p__commode
msvcrt.dll734memmove
msvcrt.dll740printf
ADVAPI32.dll456RegCloseKey
ADVAPI32.dll491RegQueryValueExA
ADVAPI32.dll460RegCreateKeyExA
ADVAPI32.dll504RegSetValueExA
KERNEL32.dll867WaitForMultipleObjects
KERNEL32.dll44CloseHandle
KERNEL32.dll911lstrcatA
KERNEL32.dll424GetSystemInfo
KERNEL32.dll328GetFileAttributesA
KERNEL32.dll568LocalFree
KERNEL32.dll564LocalAlloc
KERNEL32.dll866WaitForDebugEvent
KERNEL32.dll681ResetEvent
KERNEL32.dll559LoadLibraryExA
KERNEL32.dll229FreeLibrary
KERNEL32.dll54ContinueDebugEvent
KERNEL32.dll693SearchPathA
KERNEL32.dll220FlushInstructionCache
KERNEL32.dll811SuspendThread
KERNEL32.dll684ResumeThread
KERNEL32.dll92CreateProcessA
KERNEL32.dll873WideCharToMultiByte
KERNEL32.dll9AllocConsole
KERNEL32.dll712SetConsoleCtrlHandler
KERNEL32.dll412GetStartupInfoA
KERNEL32.dll895WriteProcessMemory
KERNEL32.dll748SetEvent
KERNEL32.dll101CreateThread
KERNEL32.dll393GetProcAddress
KERNEL32.dll359GetModuleHandleA
KERNEL32.dll440GetThreadContext
KERNEL32.dll788SetThreadContext
KERNEL32.dll558LoadLibraryA
KERNEL32.dll639QueryPerformanceFrequency
KERNEL32.dll580MapViewOfFile
KERNEL32.dll75CreateFileMappingA
KERNEL32.dll346GetLastError
KERNEL32.dll87CreateMutexA
KERNEL32.dll70CreateEventA
KERNEL32.dll171ExitProcess
KERNEL32.dll775SetPriorityClass
KERNEL32.dll303GetCurrentProcess
KERNEL32.dll456GetVersionExA
KERNEL32.dll348GetLocalTime
KERNEL32.dll446GetTickCount
KERNEL32.dll669ReleaseMutex
KERNEL32.dll869WaitForSingleObject
KERNEL32.dll616OutputDebugStringA
KERNEL32.dll174ExpandEnvironmentStringsA
KERNEL32.dll659ReadProcessMemory
KERNEL32.dll414GetStdHandle
GDI32.dll438GetTextExtentPointA
GDI32.dll588TextOutA
GDI32.dll510RestoreDC
GDI32.dll531SetBkColor
GDI32.dll524SelectObject
GDI32.dll444GetTextMetricsA
GDI32.dll58CreateFontIndirectA
GDI32.dll500Rectangle
GDI32.dll143DeleteObject
GDI32.dll517SaveDC
GDI32.dll80CreateSolidBrush
USER32.dll475MessageBeep
USER32.dll435LoadAcceleratorsA
USER32.dll314GetMessageA
USER32.dll681TranslateMDISysAccel
USER32.dll679TranslateAcceleratorA
USER32.dll682TranslateMessage
USER32.dll161DispatchMessageA
USER32.dll434KillTimer
USER32.dll513PostQuitMessage
USER32.dll542RegisterHotKey
USER32.dll278GetFocus
USER32.dll694UnregisterHotKey
USER32.dll137DefFrameProcA
USER32.dll476MessageBoxA
USER32.dll456LoadStringA
USER32.dll312GetMenuStringA
USER32.dll634SetTimer
USER32.dll300GetMenu
USER32.dll345GetSubMenu
USER32.dll561ScreenToClient
USER32.dll422IsIconic
USER32.dll432IsZoomed
USER32.dll728wsprintfA
USER32.dll194EnableMenuItem
USER32.dll372GetWindowRect
USER32.dll362GetWindow
USER32.dll270GetDesktopWindow
USER32.dll643SetWindowPos
USER32.dll273GetDlgItem
USER32.dll639SetWindowContextHelpId
USER32.dll56CheckDlgButton
USER32.dll419IsDlgButtonChecked
USER32.dll325GetParent
USER32.dll595SetDlgItemTextA
USER32.dll722WinHelpA
USER32.dll363GetWindowContextHelpId
USER32.dll198EndDialog
USER32.dll158DialogBoxParamA
USER32.dll658ShowWindow
USER32.dll91CreateMDIWindowA
USER32.dll535RegisterClassExA
USER32.dll445LoadImageA
USER32.dll439LoadCursorA
USER32.dll443LoadIconA
USER32.dll571SendMessageA
USER32.dll699UpdateWindow
USER32.dll403InvalidateRect
USER32.dll599SetForegroundWindow
USER32.dll15BringWindowToTop
USER32.dll511PostMessageA
USER32.dll139DefMDIChildProcA
USER32.dll640SetWindowLongA
USER32.dll349GetSystemMetrics
USER32.dll489MoveWindow
USER32.dll366GetWindowLongA
USER32.dll437LoadBitmapA
USER32.dll471MapWindowPoints
USER32.dll316GetMessagePos
USER32.dll200EndPaint
USER32.dll620SetRect
USER32.dll178DrawEdge
USER32.dll346GetSysColor
USER32.dll255GetClientRect
USER32.dll13BeginPaint
USER32.dll252GetClassNameA
USER32.dll580SetCapture
USER32.dll553ReleaseCapture
USER32.dll275GetDlgItemTextA
USER32.dll646SetWindowTextA
USER32.dll203EnumChildWindows
USER32.dll589SetCursor
USER32.dll523PtInRect
USER32.dll96CreateWindowExA
USER32.dll554ReleaseDC
USER32.dll268GetDC
USER32.dll153DestroyWindow
COMCTL32.dll17
COMCTL32.dll38ImageList_Create
COMCTL32.dll35ImageList_AddMasked
COMCTL32.dll83PropertySheetA
COMCTL32.dll6
COMCTL32.dll8CreateToolbarEx
DBGHELP.dll59SymGetSymFromAddr
DBGHELP.dll61SymGetSymFromName
DBGHELP.dll24StackWalk
DBGHELP.dll40SymFunctionTableAccess
DBGHELP.dll51SymGetModuleBase
DBGHELP.dll69SymInitialize
DBGHELP.dll53SymGetModuleInfo
DBGHELP.dll33SymEnumerateSymbols
DBGHELP.dll80SymSetOptions
DBGHELP.dll70SymLoadModule
comdlg32.dllChooseColorA
comdlg32.dll9GetOpenFileNameA
comdlg32.dll2ChooseFontA
SHELL32.dll147ShellAboutA

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionAPI Monitor Debugger
FileVersion5.1.2600.0 (XPClient.010817-1148)
InternalNameapimon.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameapimon.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.1.2600.0

VS_FIXEDFILEINFO

FileVersion5.1.2600.0
ProductVersion5.1.2600.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0166912EXE08/17/2001 20:53:41#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x258