filenameDismHost.exe
size82944 (0x14400)
md5f7b53b4bd50c13d17f5c54f82cde7836
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
149307299
1313072979
1473072917
10282
1323072940
126507271
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4ce78c60
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0xd02
Magic0x10b
LinkerVersion9.0
SizeOfCode0x11000
SizeOfInitializedData0x1b800
SizeOfUninitializedData0
AddressOfEntryPoint0x9a8c
BaseOfCode0x1000
BaseOfData0x12000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion5.1
Reserved10
SizeOfImage0x2e000
SizeOfHeaders0x400
CheckSum0x19840
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x10ebe0x11000R-X CODE
.data0x120000x18a9c0x400RW- IDATA
.rsrc0x2b0000xfb00x1000R-- IDATA
.reloc0x2c0000x1bbe0x1c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x10f080xb4
RESOURCE0x2b0000xfb0
EXCEPTION00
SECURITY00
BASERELOC0x2c0000xfb0
DEBUG0x13200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x58700x40
Bound_IAT0x2800xb0
IAT0x10000x2e8
Delay_IAT00
CLR_Header00
typenamesizecp
MUI#12240
TYPELIB#113240
MESSAGETABLE#12880
VERSION#19320
MANIFEST#18370
module_namehintordfunction_name
ADVAPI32.dll22AddAce
ADVAPI32.dll374InitializeAcl
ADVAPI32.dll327GetSecurityDescriptorControl
ADVAPI32.dll480MakeAbsoluteSD
ADVAPI32.dll333GetSecurityDescriptorSacl
ADVAPI32.dll328GetSecurityDescriptorDacl
ADVAPI32.dll329GetSecurityDescriptorGroup
ADVAPI32.dll331GetSecurityDescriptorOwner
ADVAPI32.dll375InitializeSecurityDescriptor
ADVAPI32.dll310GetLengthSid
ADVAPI32.dll390IsValidSid
ADVAPI32.dll118CopySid
ADVAPI32.dll292GetAclInformation
ADVAPI32.dll696SetSecurityDescriptorOwner
ADVAPI32.dll695SetSecurityDescriptorGroup
ADVAPI32.dll694SetSecurityDescriptorDacl
ADVAPI32.dll343GetSidSubAuthority
ADVAPI32.dll376InitializeSid
ADVAPI32.dll342GetSidLengthRequired
ADVAPI32.dll389IsValidSecurityDescriptor
ADVAPI32.dll622RegQueryValueExW
ADVAPI32.dll560RegCloseKey
ADVAPI32.dll609RegOpenKeyExW
KERNEL32.dll905OutputDebugStringW
KERNEL32.dll1052SearchPathW
KERNEL32.dll669GetUserDefaultUILanguage
KERNEL32.dll621GetSystemDefaultUILanguage
KERNEL32.dll1238UnmapViewOfFile
KERNEL32.dll516GetLocaleInfoW
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll854MapViewOfFile
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll1137SetLastError
KERNEL32.dll530GetModuleFileNameW
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll1358lstrlenW
KERNEL32.dll884OpenEventW
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll281ExitProcess
KERNEL32.dll840LocalFree
KERNEL32.dll1112SetEvent
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll534GetModuleHandleW
KERNEL32.dll133CreateEventW
KERNEL32.dll181CreateThread
KERNEL32.dll747InterlockedDecrement
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll739InitializeCriticalSection
KERNEL32.dll488GetFileAttributesW
KERNEL32.dll533GetModuleHandleExW
KERNEL32.dll635GetSystemWindowsDirectoryW
KERNEL32.dll675GetVersionExW
KERNEL32.dll505GetFullPathNameW
KERNEL32.dll831LoadLibraryW
KERNEL32.dll623GetSystemDirectoryW
KERNEL32.dll143CreateFileW
KERNEL32.dll579GetProcAddress
KERNEL32.dll354FreeLibrary
KERNEL32.dll333FindResourceExW
KERNEL32.dll833LoadResource
KERNEL32.dll350FormatMessageW
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll1216TerminateProcess
KERNEL32.dll632GetSystemTimeAsFileTime
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll658GetTickCount
KERNEL32.dll934QueryPerformanceCounter
KERNEL32.dll531GetModuleHandleA
KERNEL32.dll1188SetUnhandledExceptionFilter
KERNEL32.dll904OutputDebugStringA
KERNEL32.dll609GetStartupInfoA
KERNEL32.dll745InterlockedCompareExchange
KERNEL32.dll748InterlockedExchange
KERNEL32.dll674GetVersionExA
KERNEL32.dll584GetProcessHeap
KERNEL32.dll724HeapSize
KERNEL32.dll722HeapReAlloc
KERNEL32.dll719HeapFree
KERNEL32.dll715HeapAlloc
KERNEL32.dll718HeapDestroy
KERNEL32.dll944RaiseException
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll82CloseHandle
KERNEL32.dll1180SetThreadUILanguage
KERNEL32.dll391GetCommandLineW
KERNEL32.dll1202Sleep
KERNEL32.dll512GetLastError
USER32.dll175DispatchMessageW
USER32.dll764TranslateMessage
USER32.dll349GetMessageW
USER32.dll569PostThreadMessageW
USER32.dll506LoadStringW
USER32.dll773UnregisterClassA
msvcrt.dll1096_write
msvcrt.dll587_lseeki64
msvcrt.dll367_fileno
msvcrt.dll207__pioinfo
msvcrt.dll133__badioinfo
msvcrt.dll1172ferror
msvcrt.dll1390wctomb
msvcrt.dll561_itoa
msvcrt.dll815_snprintf
msvcrt.dll475_iob
msvcrt.dll478_isatty
msvcrt.dll1218isleadbyte
msvcrt.dll176__mb_cur_max
msvcrt.dll1255mbtowc
msvcrt.dll295_controlfp
msvcrt.dll1260memmove
msvcrt.dll1258memcpy
msvcrt.dll747_onexit
msvcrt.dll578_lock
msvcrt.dll141__dllonexit
msvcrt.dll934_unlock
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll210__set_app_type
msvcrt.dll1371wcsncmp
msvcrt.dll1017_wcsnicmp
msvcrt.dll1154bsearch
msvcrt.dll974_vsnwprintf
msvcrt.dll962_vscprintf
msvcrt.dll965_vscwprintf
msvcrt.dll1361wcschr
msvcrt.dll1376wcsrchr
msvcrt.dll99_CxxThrowException
msvcrt.dll764_purecall
msvcrt.dll190__p__fmode
msvcrt.dll185__p__commode
msvcrt.dll212__setusermatherr
msvcrt.dll257_amsg_exit
msvcrt.dll469_initterm
msvcrt.dll231_acmdln
msvcrt.dll1167exit
msvcrt.dll500_ismbblead
msvcrt.dll106_XcptFilter
msvcrt.dll354_exit
msvcrt.dll276_cexit
msvcrt.dll145__getmainargs
msvcrt.dll274_callnewh
msvcrt.dll11public: __thiscall exception::exception(class exception const &)

??0exception@@QAE@ABV0@@Z

msvcrt.dll16public: virtual __thiscall exception::~exception(void)

??1exception@@UAE@XZ

msvcrt.dll57public: virtual char const * __thiscall exception::what(void)const

?what@exception@@UBEPBDXZ

msvcrt.dll12public: __thiscall exception::exception(void)

??0exception@@QAE@XZ

msvcrt.dll342_errno
msvcrt.dll113__CxxFrameHandler
msvcrt.dll271_beginthreadex
msvcrt.dll1007_wcsicmp
msvcrt.dll1262memset
msvcrt.dll1157calloc
msvcrt.dll1246malloc
msvcrt.dll1190free
ntdll.dll840RtlFreeHeap
ntdll.dll1236RtlUnwind
ntdll.dll611RtlAllocateHeap
ole32.dll63CoInitializeEx
ole32.dll108CoUninitialize
ole32.dll101CoSuspendClassObjects
ole32.dll64CoInitializeSecurity
ole32.dll331ProgIDFromCLSID
ole32.dll16CoCreateInstance
ole32.dll83CoRegisterClassObject
ole32.dll8CLSIDFromString
ole32.dll95CoRevokeClassObject
ole32.dll87CoRegisterPSClsid
ole32.dll104CoTaskMemFree
OLEAUT32.dll161
OLEAUT32.dll162
OLEAUT32.dll7
OLEAUT32.dll202
OLEAUT32.dll201
OLEAUT32.dll2
OLEAUT32.dll6
OLEAUT32.dll4
SHELL32.dll6CommandLineToArgvW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionDism Host Servicing Process
FileVersion6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalNamedismhost
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameDismHost.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7601.17514

VS_FIXEDFILEINFO

FileVersion6.1.7601.17514
ProductVersion6.1.7601.17514
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
082944EXE11/20/2010 08:52:48#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280