filenamereg.exe
size62464 (0xf400)
md5d69a9abbb0d795f21995c2f48c1eb560
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd8

Rich Header

lib idversiontimes used
132307291
149307295
1473072917
10132
1313072933
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bc02c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xd800
SizeOfInitializedData0x41a00
SizeOfUninitializedData0
AddressOfEntryPoint0x1bca
BaseOfCode0x1000
BaseOfData0xe000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x52000
SizeOfHeaders0x400
CheckSum0x1cd23
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xd7600xd800R-X CODE
.data0xf0000x406dc0x600RW- IDATA
.rsrc0x500000x7e00x800R-- IDATA
.reloc0x510000x8e40xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xdce00xa0
RESOURCE0x500000x7e0
EXCEPTION00
SECURITY00
BASERELOC0x510000x8e4
DEBUG0xe7040x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x83f80x40
Bound_IAT0x2700x9c
IAT0x10000x1ec
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12000
VERSION#18960
MANIFEST#16740
module_namehintordfunction_name
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll564RegConnectRegistryW
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll612RegOpenKeyW
ADVAPI32.dll638RegSetValueExW
ADVAPI32.dll569RegCreateKeyExW
ADVAPI32.dll609RegOpenKeyExW
ADVAPI32.dll591RegEnumKeyExW
ADVAPI32.dll594RegEnumValueW
ADVAPI32.dll616RegQueryInfoKeyW
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll407LookupPrivilegeValueW
ADVAPI32.dll503OpenProcessToken
ADVAPI32.dll632RegSaveKeyW
ADVAPI32.dll631RegSaveKeyExW
ADVAPI32.dll628RegRestoreKeyW
ADVAPI32.dll602RegLoadKeyW
ADVAPI32.dll641RegUnLoadKeyW
ADVAPI32.dll598RegGetValueW
ADVAPI32.dll575RegDeleteKeyExW
ADVAPI32.dll584RegDeleteValueW
ADVAPI32.dll592RegEnumKeyW
ADVAPI32.dll595RegFlushKey
ADVAPI32.dll639RegSetValueW
ADVAPI32.dll637RegSetValueExA
KERNEL32.dll1139SetLastError
KERNEL32.dll840LocalFree
KERNEL32.dll514GetLastError
KERNEL32.dll214DeleteFileW
KERNEL32.dll643GetTempFileNameW
KERNEL32.dll645GetTempPathW
KERNEL32.dll82CloseHandle
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll117CopyFileW
KERNEL32.dll143CreateFileW
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll960ReadFile
KERNEL32.dll1317WriteFile
KERNEL32.dll836LocalAlloc
KERNEL32.dll1346lstrcmpW
KERNEL32.dll843LocalReAlloc
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll1358lstrlenW
KERNEL32.dll906OutputDebugStringW
KERNEL32.dll1126SetFilePointer
KERNEL32.dll496GetFileSize
KERNEL32.dll1053SearchPathW
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll281ExitProcess
KERNEL32.dll432GetConsoleOutputCP
KERNEL32.dll722HeapReAlloc
KERNEL32.dll719HeapFree
KERNEL32.dll724HeapSize
KERNEL32.dll715HeapAlloc
KERNEL32.dll586GetProcessHeap
KERNEL32.dll727HeapValidate
KERNEL32.dll652GetThreadLocale
KERNEL32.dll100CompareStringW
KERNEL32.dll499GetFileType
KERNEL32.dll612GetStdHandle
KERNEL32.dll428GetConsoleMode
KERNEL32.dll350FormatMessageW
KERNEL32.dll1181SetThreadUILanguage
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll1216TerminateProcess
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll659GetTickCount
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll1202Sleep
KERNEL32.dll748InterlockedExchange
msvcrt.dll1183fprintf
msvcrt.dll1387wcstoul
msvcrt.dll295_controlfp
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll345_except_handler4_common
msvcrt.dll210__set_app_type
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll1167exit
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll225__wgetmainargs
msvcrt.dll774_resetstkoflw
msvcrt.dll974_vsnwprintf
msvcrt.dll342_errno
msvcrt.dll1031_wcstoui64
msvcrt.dll147__iob_func
msvcrt.dll1173fflush
msvcrt.dll1177fgetwc
msvcrt.dll1262memset
msvcrt.dll190__p__fmode
msvcrt.dll734_memicmp
msvcrt.dll426_get_osfhandle
msvcrt.dll367_fileno
msvcrt.dll1384wcstol
ntdll.dll495NtSetInformationKey
ntdll.dll408NtQueryKey
USER32.dll451IsCharAlphaNumericW
USER32.dll506LoadStringW
USER32.dll49CharNextW
USER32.dll60CharUpperW
WS2_32.dll116
SHLWAPI.dll325StrStrIW
SHLWAPI.dll295StrDupW
SHLWAPI.dll276StrChrW
SHLWAPI.dll334StrToIntW
SHLWAPI.dll273StrChrIW
SHLWAPI.dll328StrStrW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionRegistry Console Tool
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNamereg.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamereg.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
062464EXE07/13/2009 23:15:56#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x270