filenameAdapterTroubleshooter.exe
size38912 (0x9800)
md5bdfabedacd6f18b5efb14b7529f3ed3e
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307291
1473072911
1080
132307297
1313072921
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bc5f9
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x1e00
SizeOfInitializedData0x7800
SizeOfUninitializedData0
AddressOfEntryPoint0x1ece
BaseOfCode0x1000
BaseOfData0x3000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0xc000
SizeOfHeaders0x400
CheckSum0x10cd9
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1c940x1e00R-X CODE
.data0x30000x39c0x200RW- IDATA
.rsrc0x40000x6f400x7000R-- IDATA
.reloc0xb0000x2d40x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x26dc0x64
RESOURCE0x40000x6f40
EXCEPTION00
SECURITY00
BASERELOC0xb0000x1a4
DEBUG0x11300x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x11d00x40
Bound_IAT0x2800x68
IAT0x10000x108
Delay_IAT0x25f40x60
CLR_Header00
typenamesizecp
MUI#12160
ICON#116400
ICON#27440
ICON#32960
ICON#437520
ICON#522160
ICON#613840
ICON#796400
ICON#842640
ICON#911280
GROUP_ICON#1001320
VERSION#19760
MANIFEST#113170
module_namehintordfunction_name
KERNEL32.dll715HeapAlloc
KERNEL32.dll586GetProcessHeap
KERNEL32.dll719HeapFree
KERNEL32.dll723HeapSetInformation
KERNEL32.dll1358lstrlenW
KERNEL32.dll840LocalFree
KERNEL32.dll676GetVersionExW
KERNEL32.dll1346lstrcmpW
KERNEL32.dll206DelayLoadFailureHook
KERNEL32.dll581GetProcAddress
KERNEL32.dll514GetLastError
KERNEL32.dll354FreeLibrary
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll829LoadLibraryExA
KERNEL32.dll332FindResourceExW
KERNEL32.dll832LoadResource
KERNEL32.dll851LockResource
KERNEL32.dll1231UnhandledExceptionFilter
KERNEL32.dll447GetCurrentProcess
KERNEL32.dll1212TerminateProcess
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll448GetCurrentProcessId
KERNEL32.dll452GetCurrentThreadId
KERNEL32.dll658GetTickCount
KERNEL32.dll932QueryPerformanceCounter
KERNEL32.dll532GetModuleHandleA
KERNEL32.dll1185SetUnhandledExceptionFilter
KERNEL32.dll610GetStartupInfoW
KERNEL32.dll1198Sleep
KERNEL32.dll747InterlockedExchange
USER32.dll475IsWindow
USER32.dll38ChangeDisplaySettingsW
USER32.dll656SetDlgItemTextW
USER32.dll229EnumDisplayDevicesW
USER32.dll216EnableWindow
USER32.dll636SendMessageW
USER32.dll295GetDlgItem
USER32.dll218EndDialog
USER32.dll406GetWindowLongW
USER32.dll708SetWindowLongW
USER32.dll172DialogBoxParamW
USER32.dll533MessageBoxW
msvcrt.dll106_XcptFilter
msvcrt.dll276_cexit
msvcrt.dll225__wgetmainargs
msvcrt.dll1262memset
msvcrt.dll1130_wtoi64
msvcrt.dll1229iswdigit
msvcrt.dll295_controlfp
msvcrt.dll345_except_handler4_common
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll210__set_app_type
msvcrt.dll190__p__fmode
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll257_amsg_exit
msvcrt.dll1167exit
msvcrt.dll354_exit
msvcrt.dll999_wcmdln
msvcrt.dll469_initterm
msvcrt.dll1258memcpy
d3d9.dll10Direct3DCreate9Ex

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionTroubleshoot Display Adapter
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNameAdapterTroubleshooter
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameAdapterTroubleshooter.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
038912EXE07/13/2009 23:40:41#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280