wscapi.dll - Windows Security Center API

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	wscapi.dll
size	51712 (0xca00)
md5	a8cdf3768604ff95b54669e20053d569

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
126	50727	1
149	30729	2
1	0	111
147	30729	15
146	30729	1
131	30729	15
132	30729	22
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4ce792c5
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0xae00
SizeOfInitializedData	0x1800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1371
BaseOfCode	0x1000
BaseOfData	0xc000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0xf000
SizeOfHeaders	0x400
CheckSum	0x139b9
Subsystem	2
DllCharacteristics	0x140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xaddb	0xae00	R-X CODE
.data	0xc000	0x640	0x800	RW- IDATA
.rsrc	0xd000	0x408	0x600	R-- IDATA
.reloc	0xe000	0x810	0xa00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x1e50	0x2eb
IMPORT	0xb498	0x8c
RESOURCE	0xd000	0x408
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xe000	0x810
DEBUG	0xbd7c	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x3888	0x40
Bound_IAT	0x280	0xc0
IAT	0x1000	0x160
Delay_IAT	0xb2a0	0xa0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	932	0

module_name	hint	function_name
msvcrt.dll	1259	memcpy_s
msvcrt.dll	1246	malloc
msvcrt.dll	274	_callnewh
msvcrt.dll	1190	free
msvcrt.dll	106	_XcptFilter
msvcrt.dll	469	_initterm
msvcrt.dll	747	_onexit
msvcrt.dll	578	_lock
msvcrt.dll	141	__dllonexit
msvcrt.dll	934	_unlock
msvcrt.dll	1262	memset
msvcrt.dll	9	public: __thiscall exception::exception(char const * const &) ??0exception@@QAE@ABQBD@Z
msvcrt.dll	57	public: virtual char const * __thiscall exception::what(void)const ?what@exception@@UBEPBDXZ
msvcrt.dll	16	public: virtual __thiscall exception::~exception(void) ??1exception@@UAE@XZ
msvcrt.dll	11	public: __thiscall exception::exception(class exception const &) ??0exception@@QAE@ABV0@@Z
msvcrt.dll	1261	memmove_s
msvcrt.dll	115	__CxxFrameHandler3
msvcrt.dll	99	_CxxThrowException
msvcrt.dll	1373	wcsncpy_s
msvcrt.dll	12	public: __thiscall exception::exception(void) ??0exception@@QAE@XZ
msvcrt.dll	17	public: virtual __thiscall type_info::~type_info(void) ??1type_info@@UAE@XZ
msvcrt.dll	257	_amsg_exit
msvcrt.dll	345	_except_handler4_common
ntdll.dll	1372	WinSqmAddToStream
ntdll.dll	79	EtwTraceMessage
ntdll.dll	65	EtwGetTraceEnableFlags
ntdll.dll	66	EtwGetTraceEnableLevel
ntdll.dll	67	EtwGetTraceLoggerHandle
ntdll.dll	74	EtwRegisterTraceGuidsW
ntdll.dll	81	EtwUnregisterTraceGuids
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	25	RegOpenKeyExW
API-MS-Win-Core-LocalRegistry-L1-1-0.dll	22	RegNotifyChangeKeyValue
API-MS-Win-Core-LocalRegistry-L1-1-0.dll		RegCloseKey
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	13	GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	42	TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	11	GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	10	GetCurrentProcess
RPCRT4.dll	483	RpcSsDestroyClientContext
RPCRT4.dll	394	RpcExceptionFilter
RPCRT4.dll	349	RpcBindingFree
RPCRT4.dll	494	RpcStringBindingComposeW
RPCRT4.dll	351	RpcBindingFromStringBindingW
RPCRT4.dll	498	RpcStringFreeW
RPCRT4.dll	149	NdrClientCall2
KERNEL32.dll	718	HeapFree
KERNEL32.dll	583	GetProcessHeap
KERNEL32.dll	96	CompareFileTime
KERNEL32.dll	993	RegQueryValueExW
KERNEL32.dll	714	HeapAlloc
KERNEL32.dll	205	DelayLoadFailureHook
KERNEL32.dll	529	GetModuleFileNameW
KERNEL32.dll	830	LoadLibraryW
KERNEL32.dll	180	CreateThread
KERNEL32.dll	354	FreeLibraryAndExitThread
KERNEL32.dll	533	GetModuleHandleW
KERNEL32.dll	1184	SetUnhandledExceptionFilter
KERNEL32.dll	237	EnterCriticalSection
KERNEL32.dll	824	LeaveCriticalSection
KERNEL32.dll	208	DeleteCriticalSection
KERNEL32.dll	738	InitializeCriticalSection
KERNEL32.dll	1109	SetEvent
KERNEL32.dll	746	InterlockedDecrement
KERNEL32.dll	940	QueueUserWorkItem
KERNEL32.dll	750	InterlockedIncrement
KERNEL32.dll	221	DisableThreadLibraryCalls
KERNEL32.dll	1238	UnregisterWait
KERNEL32.dll	511	GetLastError
KERNEL32.dll	1009	RegisterWaitForSingleObject
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	133	CreateEventW
KERNEL32.dll	1198	Sleep
KERNEL32.dll	1269	WaitForSingleObject
KERNEL32.dll	1239	UnregisterWaitEx
KERNEL32.dll	1231	UnhandledExceptionFilter
KERNEL32.dll	578	GetProcAddress
KERNEL32.dll	353	FreeLibrary
KERNEL32.dll	744	InterlockedCompareExchange
KERNEL32.dll	828	LoadLibraryExA
KERNEL32.dll	747	InterlockedExchange
KERNEL32.dll	931	QueryPerformanceCounter
KERNEL32.dll	657	GetTickCount
KERNEL32.dll	631	GetSystemTimeAsFileTime

ord	entry_va	function_name
1	0x21a5	WscGetSecurityProviderHealth
2	0x32aa	WscRegisterForChanges
3	0x3c34	WscUnRegisterChanges
4	0x26c4	wscAntiSpywareGetStatus
5	0x2634	wscAntiVirusGetStatus
6	0x6ab1	wscAutoUpdatesEnableScheduledMode
7	0x25a4	wscAutoUpdatesGetStatus
8	0x24f7	wscFirewallGetStatus
9	0x34d6	wscGeneralSecurityGetStatus
10	0x341b	wscGetAlertStatus
11	0x6b29	wscIcfEnable
12	0x6a11	wscIeSettingsFix
13	0x6ba1	wscLuaSettingsFix
14	0x6a2f	wscOverrideComponentStatus
15	0x2291	wscPing
16	0x346b	wscProductInfoFree
17	0x2f8b	wscRegisterChangeNotification
18	0x6c19	wscRegisterSecurityProduct
19	0x3d52	wscUnRegisterChangeNotification
20	0x6cb1	wscUnregisterSecurityProduct
21	0x3584	wscUpdateProductStatus

module_name	WSCAPI.dll
flags	0
timestamp	2010-11-20 09:20:05
version	0.0
ordinal_base	1
nFunctions	21
nNames	21
Names(21)	0x1ecc
Functions(21)	0x1e78
NameOrdinals(21)	0x1f20

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Security Center API
FileVersion	6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName	wscapi.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	wscapi.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion	6.1.7601.17514
ProductVersion	6.1.7601.17514
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	51712	DLL	11/20/2010 09:20:05	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x280

wscapi.dll-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

wscapi.dll
-