filenamewlsrvc.dll
size110080 (0x1ae00)
md5fe60ed34448004e474d3229ad0c35d97
typePE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
189307163
1883071614
187307163
10140
1853071617
184307161
1933071625
183307161
186307161

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4fb704ad
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion10.10
SizeOfCode0xfa00
SizeOfInitializedData0xb600
SizeOfUninitializedData0
AddressOfEntryPoint0xdf7f
BaseOfCode0x1000
BaseOfData0x11000
ImageBase0x10000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.2
ImageVersion6.2
SubsystemVersion6.2
Reserved10
SizeOfImage0x1e000
SizeOfHeaders0x400
CheckSum0x215f4
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000xf9c50xfa00R-X CODE
.data0x110000x92c0x400RW- IDATA
.idata0x120000xc860xe00R-- IDATA
.rsrc0x130000x83f80x8400R-- IDATA
.reloc0x1c0000x188e0x1a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x109100xb5
IMPORT0x120000xb4
RESOURCE0x130000x83f8
EXCEPTION00
SECURITY00
BASERELOC0x1c0000xf78
DEBUG0x10200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x35b00x40
Bound_IAT0x2b80xdc
IAT0x122cc0x218
Delay_IAT00
CLR_Header00
typenamesizecp
REGISTRY#5008420
REGISTRY#5018450
TYPELIB#1308680
VERSION#18920
module_namehintordfunction_name
msvcrt.dll1131_wtof
msvcrt.dll1137_wtol
msvcrt.dll1380wcsrchr
msvcrt.dll977_vsnwprintf
msvcrt.dll1194free
msvcrt.dll1250malloc
msvcrt.dll1264memmove
msvcrt.dll1369wcscpy_s
msvcrt.dll1262memcpy
msvcrt.dll1261memcmp
msvcrt.dll406_ftol2
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll99_CxxThrowException
msvcrt.dll767_purecall
msvcrt.dll41void * __cdecl operator new[](unsigned int)

??_U@YAPAXI@Z

msvcrt.dll1384wcsstr
msvcrt.dll1233iswdigit
msvcrt.dll1364wcscat_s
msvcrt.dll1134_wtoi64
msvcrt.dll926_ui64tow_s
msvcrt.dll106_XcptFilter
msvcrt.dll257_amsg_exit
msvcrt.dll472_initterm
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll581_lock
msvcrt.dll937_unlock
msvcrt.dll141__dllonexit
msvcrt.dll750_onexit
msvcrt.dll17public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll346_except_handler4_common
msvcrt.dll43void __cdecl operator delete[](void *)

??_V@YAXPAX@Z

msvcrt.dll1266memset
ATL.DLL18
ATL.DLL15
ATL.DLL21
ATL.DLL16
ATL.DLL23
ATL.DLL30
ATL.DLL58
ATL.DLL32
ATL.DLL22
KERNEL32.dll547GetCurrentProcessId
KERNEL32.dll1081QueryPerformanceCounter
KERNEL32.dll875InterlockedExchange
KERNEL32.dll162CompareFileTime
KERNEL32.dll753GetSystemTimeAsFileTime
KERNEL32.dll375FileTimeToLocalFileTime
KERNEL32.dll1182RemoveDirectoryW
KERNEL32.dll551GetCurrentThreadId
KERNEL32.dll410FindNextFileW
KERNEL32.dll398FindFirstFileW
KERNEL32.dll290DeleteFileW
KERNEL32.dll533GetCurrencyFormatW
KERNEL32.dll618GetLocaleInfoEx
KERNEL32.dll941LCMapStringEx
KERNEL32.dll1273SetEvent
KERNEL32.dll791GetUserDefaultLCID
KERNEL32.dll781GetTickCount
KERNEL32.dll1417UnhandledExceptionFilter
KERNEL32.dll1355SetUnhandledExceptionFilter
KERNEL32.dll546GetCurrentProcess
KERNEL32.dll1385TerminateProcess
KERNEL32.dll775GetThreadPreferredUILanguages
KERNEL32.dll387FindClose
KERNEL32.dll296DeleteTimerQueueEx
KERNEL32.dll842HeapAlloc
KERNEL32.dll846HeapFree
KERNEL32.dll695GetProcessHeap
KERNEL32.dll166CompareStringW
KERNEL32.dll954LeaveCriticalSection
KERNEL32.dll319EnterCriticalSection
KERNEL32.dll874InterlockedDecrement
KERNEL32.dll878InterlockedIncrement
KERNEL32.dll1490WideCharToMultiByte
KERNEL32.dll615GetLastError
KERNEL32.dll1001MultiByteToWideChar
KERNEL32.dll751GetSystemTime
KERNEL32.dll616GetLocalTime
KERNEL32.dll301DisableThreadLibraryCalls
KERNEL32.dll285DeleteCriticalSection
KERNEL32.dll866InitializeCriticalSection
KERNEL32.dll228CreateMutexW
KERNEL32.dll141CloseHandle
KERNEL32.dll1460WaitForSingleObject
KERNEL32.dll213CreateFileW
KERNEL32.dll597GetFileTime
KERNEL32.dll376FileTimeToSystemTime
KERNEL32.dll1172ReleaseMutex
KERNEL32.dll970LocalFree
KERNEL32.dll966LocalAlloc
KERNEL32.dll872InterlockedCompareExchange
KERNEL32.dll1370Sleep
KERNEL32.dll867InitializeCriticalSectionAndSpinCount
KERNEL32.dll201CreateEventW
KERNEL32.dll263CreateTimerQueue
KERNEL32.dll264CreateTimerQueueTimer
KERNEL32.dll297DeleteTimerQueueTimer
KERNEL32.dll795GetUserGeoID
KERNEL32.dll619GetLocaleInfoW
KERNEL32.dll609GetGeoInfoW
USER32.dll59CharUpperBuffW
SHLWAPI.dll56PathAppendW
ole32.dll242IIDFromString
ole32.dll438StringFromIID
ole32.dll24CoCreateGuid
ole32.dll125CoUninitialize
ole32.dll78CoInitialize
ole32.dll10CLSIDFromProgID
ole32.dll120CoTaskMemAlloc
ole32.dll25CoCreateInstance
ole32.dll121CoTaskMemFree
OLEAUT32.dll16
OLEAUT32.dll26
OLEAUT32.dll40
OLEAUT32.dll15
OLEAUT32.dll146
OLEAUT32.dll184
OLEAUT32.dll7
OLEAUT32.dll2
OLEAUT32.dll162
OLEAUT32.dll9
OLEAUT32.dll4
OLEAUT32.dll6
SHELL32.dll202SHGetFolderPathAndSubDirW
SHELL32.dll205SHGetFolderPathW
SHELL32.dll145SHCreateDirectoryExW
ordentry_vafunction_name
10x57a1DllCanUnloadNow
20x57b2DllGetClassObject
30x5766DllMain
40x57d4DllRegisterServer
50x57e9DllUnregisterServer
module_namewlsrvc.dll
flags0
timestamp2012-05-18 23:36:39
version0.0
ordinal_base1
nFunctions5
nNames5
Names(5)0x1094c
Functions(5)0x10938
NameOrdinals(5)0x10960

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Live Services
FileVersion6.2.8400.0 (winmain_win8rc.120518-1423)
InternalNamewlsrvc
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenamewlsrvc
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.2.8400.0

VS_FIXEDFILEINFO

FileVersion6.2.8400.0
ProductVersion6.2.8400.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
0110080DLL05/19/2012 02:25:49#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x2b8