47827a95bc51501f6c057dc33521404526f1d3af.bin - Setup.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	47827a95bc51501f6c057dc33521404526f1d3af.bin
size	843776 (0xce000)
md5	7eb21486d4d98a880e391651f849237b

type	PE32 executable (GUI), for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x118

Rich Header

lib id	version	times used
18	8444	1
95	2179	11
25	9210	4
19	8078	23
93	2067	2
93	2179	23
1	0	654
15	3077	28
95	3077	135
39	8491	9
96	3077	145
94	3052	1
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x100
NumberOfSections	4
TimeDateStamp	0x49ede40d
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x43000
SizeOfInitializedData	0x42000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x87014
BaseOfCode	0x1000
BaseOfData	0x44000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1d0000
SizeOfHeaders	0x1000
CheckSum	0xd27cb
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Themida 1.8.x.x (Oreans Technologies)

Sections

name	va	vsize	raw size	flags
	0x1000	0x80000	0x3a000	RWX IDATA
.rsrc	0x81000	0x4ff0	0x3000	RW- IDATA
.idata	0x86000	0x1000	0x1000	RW- IDATA
Themida	0x87000	0x149000	0x8f000	RWX IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x86014	0x3c
RESOURCE	0x81000	0x4ff0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x51ad0	0x40
CLR_Header	0	0

show previews

type	name	size
CURSOR	#3	308
CURSOR	#4	180
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	308
CURSOR	#9	308
CURSOR	#10	308
CURSOR	#11	308
CURSOR	#12	308
CURSOR	#13	308
CURSOR	#14	308
CURSOR	#15	308
CURSOR	#16	308
CURSOR	#17	308
CURSOR	#18	308
BITMAP	#30994	184
BITMAP	#30996	324
ICON	#1	1384
ICON	#2	2216
MENU	#172	98
MENU	#173	88
DIALOG	#100	184
DIALOG	#103	208
DIALOG	#104	208
DIALOG	#30721	232
STRING	#7	60
STRING	#3841	130
STRING	#3842	42
STRING	#3843	402
STRING	#3857	1250
STRING	#3858	794
STRING	#3859	732
STRING	#3860	138
STRING	#3865	172
STRING	#3866	222
STRING	#3867	1220
STRING	#3868	612
STRING	#3869	44
STRING	#3887	66
GROUP_CURSOR	#30977	34
GROUP_CURSOR	#30998	20
GROUP_CURSOR	#30999	20
GROUP_CURSOR	#31000	20
GROUP_CURSOR	#31001	20
GROUP_CURSOR	#31002	20
GROUP_CURSOR	#31003	20
GROUP_CURSOR	#31004	20
GROUP_CURSOR	#31005	20
GROUP_CURSOR	#31006	20
GROUP_CURSOR	#31007	20
GROUP_CURSOR	#31008	20
GROUP_CURSOR	#31009	20
GROUP_CURSOR	#31010	20
GROUP_CURSOR	#31011	20
GROUP_ICON	#1	34
VERSION	#1	616
MANIFEST	#1	439

module_name	hint	ord	function_name
KERNEL32.dll			CreateFileA
KERNEL32.dll			lstrcpy
COMCTL32.dll			InitCommonControls

StringTable 040904b0

FileDescription	Bi soft
FileVersion	1, 0, 0, 1
InternalName	Bisoft®
LegalCopyright	Copyright (C) 2009
OriginalFilename	Setup.exe
ProductName	HLM
ProductVersion	1, 0, 0, 1

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x17
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	843776	EXE	04/21/2009 15:19:41	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x84088

[?] can't find file_offset of VA 0x841d8

[?] can't find file_offset of VA 0x84328

[?] can't find file_offset of VA 0x84478

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x846b0

[?] can't find file_offset of VA 0x84768

[?] can't find file_offset of VA 0x845c8

[?] can't find file_offset of VA 0x848b0

[?] can't find file_offset of VA 0x848f0

[?] can't find file_offset of VA 0x84978

[?] can't find file_offset of VA 0x849a8

[?] can't find file_offset of VA 0x84b40

[?] can't find file_offset of VA 0x853b8

[?] can't find file_offset of VA 0x850d8

[?] can't find file_offset of VA 0x85f18

[?] can't find file_offset of VA 0x85028

[?] can't find file_offset of VA 0x85e08

[?] can't find file_offset of VA 0x856d8

[?] can't find file_offset of VA 0x85ba0

[?] can't find file_offset of VA 0x85ee8

[?] can't find file_offset of VA 0x85fa8

[?] can't find file_offset of VA 0x841c0

[?] can't find file_offset of VA 0x84070

[?] can't find file_offset of VA 0x84310

[?] can't find file_offset of VA 0x84460

[?] can't find file_offset of VA 0x845b0

[?] can't find file_offset of VA 0x51ad0

47827a95bc51501f6c057dc33521404526f1d3af.bin- Setup.exe - Bi soft