filenamewinnsi.dll
size16896 (0x4200)
md5cff35b879d1618d42c86644c717ba947
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
149307291
1059
1473072929
146307291
1313072915
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bdb43
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x3000
SizeOfInitializedData0xe00
SizeOfUninitializedData0
AddressOfEntryPoint0x128d
BaseOfCode0x1000
BaseOfData0x4000
ImageBase0x3fd90000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x7000
SizeOfHeaders0x600
CheckSum0x6a64
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000x2e070x3000R-X CODE
.data0x40000x3880x200RW- IDATA
.rsrc0x50000x4180x600R-- IDATA
.reloc0x60000x21c0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1c340x254
IMPORT0x35380x12c
RESOURCE0x50000x418
EXCEPTION00
SECURITY00
BASERELOC0x60000x21c
DEBUG0x3da80x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x2ad00x40
Bound_IAT0x2700x24c
IAT0x10000x110
Delay_IAT00
CLR_Header00
typenamesizecp
VERSION#19480
module_namehintordfunction_name
msvcrt.dll345_except_handler4_common
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll1190free
msvcrt.dll1246malloc
msvcrt.dll106_XcptFilter
msvcrt.dll1262memset
RPCRT4.dll494RpcStringBindingComposeW
RPCRT4.dll351RpcBindingFromStringBindingW
RPCRT4.dll498RpcStringFreeW
RPCRT4.dll367RpcBindingSetAuthInfoW
RPCRT4.dll349RpcBindingFree
RPCRT4.dll340RpcAsyncCancelCall
RPCRT4.dll341RpcAsyncCompleteCall
RPCRT4.dll45I_RpcExceptionFilter
RPCRT4.dll343RpcAsyncInitializeHandle
RPCRT4.dll139NdrAsyncClientCall
NSI.dll5NsiEnumerateObjectsAllParameters
NSI.dll21NsiSetAllParametersEx
NSI.dll25NsiSetParameterEx
NSI.dll11NsiGetAllParametersEx
NSI.dll15NsiGetParameterEx
API-MS-Win-Core-ErrorHandling-L1-1-0.dll1GetLastError
API-MS-Win-Core-ErrorHandling-L1-1-0.dll6UnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll5SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll4SetLastError
API-MS-Win-Core-Handle-L1-1-0.dllCloseHandle
API-MS-Win-Core-Heap-L1-1-0.dllGetProcessHeap
API-MS-Win-Core-Heap-L1-1-0.dll6HeapFree
API-MS-Win-Core-Heap-L1-1-0.dll2HeapAlloc
API-MS-Win-Core-Interlocked-L1-1-0.dll7InterlockedIncrement
API-MS-Win-Core-Interlocked-L1-1-0.dll4InterlockedExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll1InterlockedCompareExchange
API-MS-Win-Core-Interlocked-L1-1-0.dll3InterlockedDecrement
API-MS-Win-Core-LibraryLoader-L1-1-0.dllDisableThreadLibraryCalls
API-MS-Win-Core-Misc-L1-1-0.dll10LocalAlloc
API-MS-Win-Core-Misc-L1-1-0.dll11LocalFree
API-MS-Win-Core-Misc-L1-1-0.dll19Sleep
API-MS-Win-Core-ProcessThreads-L1-1-0.dll11GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll42TerminateProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll10GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll13GetCurrentThreadId
API-MS-Win-Core-Profile-L1-1-0.dllQueryPerformanceCounter
API-MS-Win-Core-Synch-L1-1-0.dll6CreateEventW
API-MS-Win-Core-Synch-L1-1-0.dll19LeaveCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll14EnterCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll32SetEvent
API-MS-Win-Core-Synch-L1-1-0.dll16InitializeCriticalSectionAndSpinCount
API-MS-Win-Core-Synch-L1-1-0.dll13DeleteCriticalSection
API-MS-Win-Core-Synch-L1-1-0.dll40WaitForSingleObject
API-MS-Win-Core-SysInfo-L1-1-0.dll11GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll14GetTickCount
API-MS-Win-Core-ThreadPool-L1-1-0.dll25RegisterWaitForSingleObjectEx
API-MS-Win-Core-ThreadPool-L1-1-0.dll37UnregisterWaitEx
ordentry_vafunction_name
10x217eNsiConnectToServer
20x1be1NsiDisconnectFromServer
30x2255NsiRpcDeregisterChangeNotification
40x2292NsiRpcDeregisterChangeNotificationEx
50x3071NsiRpcEnumerateObjectsAllParameters
60x2cf9NsiRpcGetAllParameters
70x2be3NsiRpcGetAllParametersEx
80x245dNsiRpcGetParameter
90x24ccNsiRpcGetParameterEx
100x1ebcNsiRpcRegisterChangeNotification
110x1f0dNsiRpcRegisterChangeNotificationEx
120x3011NsiRpcSetAllParameters
130x2efaNsiRpcSetAllParametersEx
140x2e89NsiRpcSetParameter
150x2d74NsiRpcSetParameterEx
module_nameWINNSI.DLL
flags0
timestamp2009-07-13 23:12:04
version0.0
ordinal_base1
nFunctions15
nNames15
Names(15)0x1c98
Functions(15)0x1c5c
NameOrdinals(15)0x1cd4

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionNetwork Store Information RPC interface
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamewinnsi.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamewinnsi.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
016896DLL07/14/2009 01:11:31#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x270