RightTime.exe - MFC-Anwendung RightTime

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	RightTime.exe
size	103936 (0x19600)
md5	bf7a1d38613f9ca0892ec6cb5d162edb

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
19	8022	37
10	8447	1
0	0	47
19	8034	19
1	0	462
11	8047	10
14	7299	27
10	8047	141
11	8569	80
11	8966	3
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x3dbc5124
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x22000
SizeOfInitializedData	0x16000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x39001
BaseOfCode	0x1000
BaseOfData	0x23000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x3c000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.1

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x22000	0x12400	RW- IDATA
.rdata	0x23000	0x9000	0x2a00	RW- IDATA
.data	0x2c000	0x9000	0xc00	RW- IDATA
.rsrc	0x35000	0x4000	0x1200	RW- IDATA
.qtest	0x39000	0x2000	0x1a00	RW- IDATA
.data	0x3b000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x39fbc	0x260
RESOURCE	0x35000	0x3b10
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x39e54	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

show previews

type	name	size
CURSOR	#3	308
CURSOR	#4	180
BITMAP	#26567	1508
BITMAP	#30994	184
BITMAP	#30995	364
BITMAP	#30996	324
ICON	#1	744
ICON	#2	296
DIALOG	#102	1524
DIALOG	#30721	238
STRING	#3841	170
STRING	#3842	52
STRING	#3843	440
STRING	#3857	1632
STRING	#3858	898
STRING	#3859	910
STRING	#3865	272
STRING	#3866	384
STRING	#3867	1618
STRING	#3868	762
STRING	#3869	42
GROUP_CURSOR	#30977	34
GROUP_ICON	#128	34
VERSION	#1	764

module_name	ord	function_name
kernel32.dll		GetProcAddress
kernel32.dll		GetModuleHandleA
kernel32.dll		LoadLibraryA
user32.dll		InvalidateRect
gdi32.dll		DeleteObject
comdlg32.dll		GetFileTitleA
winspool.drv		ClosePrinter
advapi32.dll		RegCloseKey
shell32.dll		SHGetPathFromIDListA
comctl32.dll	17
oledlg.dll	8
ole32.dll		CoFreeUnusedLibraries
olepro32.dll	253
oleaut32.dll	7

StringTable 040704B0

CompanyName
FileDescription	MFC-Anwendung RightTime
FileVersion	1, 0, 0, 1
InternalName	RightTime
LegalCopyright	Copyright (C) 2002
LegalTrademarks
OriginalFilename	RightTime.EXE
ProductName	Anwendung RightTime
ProductVersion	1, 0, 0, 1

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	103936	EXE	10/27/2002 20:48:36	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x36280

[?] can't find file_offset of VA 0x363b8

[?] can't find file_offset of VA 0x36498

[?] can't find file_offset of VA 0x36b70

[?] can't find file_offset of VA 0x36c28

[?] can't find file_offset of VA 0x36d98

[?] can't find file_offset of VA 0x36a80

[?] can't find file_offset of VA 0x36ee0

[?] can't find file_offset of VA 0x36f90

[?] can't find file_offset of VA 0x36fc8

[?] can't find file_offset of VA 0x37180

[?] can't find file_offset of VA 0x37c80

[?] can't find file_offset of VA 0x378f0

[?] can't find file_offset of VA 0x377e0

[?] can't find file_offset of VA 0x38960

[?] can't find file_offset of VA 0x38008

[?] can't find file_offset of VA 0x38660

[?] can't find file_offset of VA 0x38ae0

[?] can't find file_offset of VA 0x36470

[?] can't find file_offset of VA 0x0

RightTime.exe- MFC-Anwendung RightTime