XiaobaiOnekey_V5.1.9.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	XiaobaiOnekey_V5.1.9.exe
size	5789184 (0x585600)
md5	00974078367b683d8b90be67f475149a

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xb
TimeDateStamp	0x2a425e19
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x15f800
SizeOfInitializedData	0xc1a600
SizeOfUninitializedData	0
AddressOfEntryPoint	0xda1001
BaseOfCode	0x1000
BaseOfData	0x161000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xda8000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.12

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
CODE	0x1000	0x160000	0x7c000	RW- IDATA
DATA	0x161000	0x15000	0xbc00	RW- IDATA
BSS	0x176000	0xb000	0	RW- IDATA
.idata	0x181000	0x3000	0x1200	RW- IDATA
.tls	0x184000	0x1000	0	RW- IDATA
.rdata	0x185000	0x1000	0x200	RW- IDATA
.odata0	0x186000	0x17000	0x15e00	RW- IDATA
.rsrc	0x19d000	0xbed000	0x4e0600	RW- IDATA
.reloc	0xd8a000	0x17000	0	RW- IDATA
.aspack	0xda1000	0x6000	0x5e00	RW- IDATA
.adata	0xda7000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xda1fac	0x458
RESOURCE	0x19d000	0xbec600
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xda1f54	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xda1f3c	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

TLS

raw start	raw end	index	callbks	zero fill	flags
0x584000	0x584010	0x5610a0	0x585010	0	0

show previews

type	name	size
XBGHOSTFILE	XBGHOST_RES_USER1	269885
XBGHOSTFILE	XBGHOST_RES_USER10	268744
XBGHOSTFILE	XBGHOST_RES_USER11	19968
XBGHOSTFILE	XBGHOST_RES_USER12	503808
XBGHOSTFILE	XBGHOST_RES_USER13	348160
XBGHOSTFILE	XBGHOST_RES_USER14	100808
XBGHOSTFILE	XBGHOST_RES_USER15	248264
XBGHOSTFILE	XBGHOST_RES_USER16	59904
XBGHOSTFILE	XBGHOST_RES_USER17	24072
XBGHOSTFILE	XBGHOST_RES_USER18	55808
XBGHOSTFILE	XBGHOST_RES_USER19	73160
XBGHOSTFILE	XBGHOST_RES_USER2	9216
XBGHOSTFILE	XBGHOST_RES_USER20	59848
XBGHOSTFILE	XBGHOST_RES_USER3	4423680
XBGHOSTFILE	XBGHOST_RES_USER4	302144
XBGHOSTFILE	XBGHOST_RES_USER5	293320
XBGHOSTFILE	XBGHOST_RES_USER6	89600
XBGHOSTFILE	XBGHOST_RES_USER7	92080
XBGHOSTFILE	XBGHOST_RES_USER8	3512776
XBGHOSTFILE	XBGHOST_RES_USER9	40
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	BLUEGLASS_BUTTON	7328
BITMAP	BLUEGLASS_CHECKBOX	468
BITMAP	BLUEGLASS_CHECKLIST	368
BITMAP	BLUEGLASS_PROGRESSBAR	1104
BITMAP	BLUEGLASS_RADIOBUTTON	468
BITMAP	BLUEGLASS_SCROLLBAR_BUTTON	936
BITMAP	BLUEGLASS_SCROLLBAR_TRACK	1448
BITMAP	BLUEGLASS_SIDECHENNEL_BAR	188
BITMAP	BLUEGLASS_SIDECHENNEL_HANDLE	1752
BITMAP	BLUEGLASS_TAB	308
BITMAP	BLUEGLASS_TAB_LINE	144
BITMAP	BLUEGLASS_TITLEBTN	3372
BITMAP	BLUEGLASS_TITLE_CLIENT	7004
BITMAP	BLUEGLASS_TITLE_LEFT	6476
BITMAP	BLUEGLASS_TITLE_RIGHT	4496
BITMAP	BLUEGLASS_TRACKBAR_BAR	586
BITMAP	BLUEGLASS_TRACKBAR_SLIDER	762
BITMAP	BLUEGLASS_TRACKBAR_SLIDER_V	766
BITMAP	BS_BB_DOWN	192
BITMAP	BS_BB_UP	192
BITMAP	BS_BRUSH_BD	488
BITMAP	BS_BRUSH_CLEAR	488
BITMAP	BS_BRUSH_CROSS	488
BITMAP	BS_BRUSH_DCROSS	488
BITMAP	BS_BRUSH_FD	488
BITMAP	BS_BRUSH_H	488
BITMAP	BS_BRUSH_SOLID	488
BITMAP	BS_BRUSH_V	488
BITMAP	BS_GRAD_HORZ_IN	1704
BITMAP	BS_GRAD_HORZ_INOUT	1704
BITMAP	BS_GRAD_HORZ_OUT	1704
BITMAP	BS_GRAD_VERT_IN	1704
BITMAP	BS_GRAD_VERT_INOUT	1704
BITMAP	BS_GRAD_VERT_OUT	1704
BITMAP	BS_HRL	264
BITMAP	BS_HTB	520
BITMAP	BS_NEXTMONTH	232
BITMAP	BS_NEXTYEAR	232
BITMAP	BS_PEN1	424
BITMAP	BS_PEN2	424
BITMAP	BS_PEN3	424
BITMAP	BS_PEN4	424
BITMAP	BS_PEN6	424
BITMAP	BS_PEN_DASH	464
BITMAP	BS_PEN_DASHDOT	464
BITMAP	BS_PEN_DASHDOTDOT	464
BITMAP	BS_PEN_DOT	464
BITMAP	BS_PEN_SOLID	464
BITMAP	BS_PRIORMONTH	232
BITMAP	BS_PRIORYEAR	232
BITMAP	BS_SHADOW1	344
BITMAP	BS_SHADOW10	344
BITMAP	BS_SHADOW11	344
BITMAP	BS_SHADOW12	344
BITMAP	BS_SHADOW13	344
BITMAP	BS_SHADOW14	344
BITMAP	BS_SHADOW15	344
BITMAP	BS_SHADOW16	344
BITMAP	BS_SHADOW17	344
BITMAP	BS_SHADOW18	344
BITMAP	BS_SHADOW19	344
BITMAP	BS_SHADOW2	344
BITMAP	BS_SHADOW20	344
BITMAP	BS_SHADOW21	344
BITMAP	BS_SHADOW3	344
BITMAP	BS_SHADOW4	344
BITMAP	BS_SHADOW5	344
BITMAP	BS_SHADOW6	344
BITMAP	BS_SHADOW7	344
BITMAP	BS_SHADOW8	344
BITMAP	BS_SHADOW9	344
BITMAP	BS_VRL	280
BITMAP	BS_VTB	712
BITMAP	DBEDIT	92
BITMAP	DBGARROW	92
BITMAP	DBINSERT	92
ICON	#1	9640
ICON	#2	4264
ICON	#3	2440
ICON	#4	1128
GROUP_ICON	MAINICON	62
VERSION	#1	616
MANIFEST	#1	778

module_name	hint	ord	function_name
kernel32.dll			GetProcAddress
kernel32.dll			GetModuleHandleA
kernel32.dll			LoadLibraryA
user32.dll			GetKeyboardType
advapi32.dll			RegQueryValueExA
oleaut32.dll			SysFreeString
advapi32.dll			RegSetValueExA
version.dll			VerQueryValueA
gdi32.dll			UnrealizeObject
user32.dll			CreateWindowExA
ole32.dll			IsEqualGUID
oleaut32.dll			SafeArrayPtrOfIndex
ole32.dll			CreateStreamOnHGlobal
oleaut32.dll			GetErrorInfo
comctl32.dll			ImageList_SetIconSize
shell32.dll			Shell_NotifyIconA
wininet.dll			InternetSetOptionA
urlmon.dll			CoInternetCreateZoneManager
shell32.dll			SHGetSpecialFolderLocation
comdlg32.dll			GetOpenFileNameA
netapi32.dll			Netbios

StringTable 080403A8

CompanyName
FileDescription
FileVersion	5.1.9.1
InternalName
LegalCopyright
LegalTrademarks
OriginalFilename
ProductName	小白一键重装系统
ProductVersion	5.1.9.1

VS_FIXEDFILEINFO

FileVersion	5.1.9.1
ProductVersion	5.1.9.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	5783600	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x7ce368

[?] can't find file_offset of VA 0x817fa8

[?] can't find file_offset of VA 0x85f970

[?] can't find file_offset of VA 0x875770

[?] can't find file_offset of VA 0x88bf20

[?] can't find file_offset of VA 0xbe58e8

[?] can't find file_offset of VA 0xbe5910

[?] can't find file_offset of VA 0xbe5a44

[?] can't find file_offset of VA 0xbe5b78

[?] can't find file_offset of VA 0xbe5cac

[?] can't find file_offset of VA 0xbe5de0

[?] can't find file_offset of VA 0xbe5f14

[?] can't find file_offset of VA 0xbe6048

[?] can't find file_offset of VA 0xbe617c

[?] can't find file_offset of VA 0xbe62b0

[?] can't find file_offset of VA 0xbe6480

[?] can't find file_offset of VA 0xbe6664

[?] can't find file_offset of VA 0xbe6834

[?] can't find file_offset of VA 0xbe6a04

[?] can't find file_offset of VA 0xbe6bd4

[?] can't find file_offset of VA 0xbe6da4

[?] can't find file_offset of VA 0xbe6f74

[?] can't find file_offset of VA 0xbe7144

[?] can't find file_offset of VA 0xbe7314

[?] can't find file_offset of VA 0xbe74e4

[?] can't find file_offset of VA 0xbe9184

[?] can't find file_offset of VA 0xbe9358

[?] can't find file_offset of VA 0xbe94c8

[?] can't find file_offset of VA 0xbe9918

[?] can't find file_offset of VA 0xbe9aec

[?] can't find file_offset of VA 0xbe9e94

[?] can't find file_offset of VA 0xbea43c

[?] can't find file_offset of VA 0xbea4f8

[?] can't find file_offset of VA 0xbeabd0

[?] can't find file_offset of VA 0xbead04

[?] can't find file_offset of VA 0xbead94

[?] can't find file_offset of VA 0xbebac0

[?] can't find file_offset of VA 0xbed61c

[?] can't find file_offset of VA 0xbeef68

[?] can't find file_offset of VA 0xbf00f8

[?] can't find file_offset of VA 0xbf0344

[?] can't find file_offset of VA 0xbf0640

[?] can't find file_offset of VA 0xbf0940

[?] can't find file_offset of VA 0xbf0a00

[?] can't find file_offset of VA 0xbf0ac0

[?] can't find file_offset of VA 0xbf0ca8

[?] can't find file_offset of VA 0xbf0e90

[?] can't find file_offset of VA 0xbf1078

[?] can't find file_offset of VA 0xbf1260

[?] can't find file_offset of VA 0xbf1448

[?] can't find file_offset of VA 0xbf1630

[?] can't find file_offset of VA 0xbf1818

[?] can't find file_offset of VA 0xbf1a00

[?] can't find file_offset of VA 0xbf20a8

[?] can't find file_offset of VA 0xbf2750

[?] can't find file_offset of VA 0xbf2df8

[?] can't find file_offset of VA 0xbf34a0

[?] can't find file_offset of VA 0xbf3b48

[?] can't find file_offset of VA 0xbf41f0

[?] can't find file_offset of VA 0xbf42f8

[?] can't find file_offset of VA 0xbf4500

[?] can't find file_offset of VA 0xbf45e8

[?] can't find file_offset of VA 0xbf46d0

[?] can't find file_offset of VA 0xbf4878

[?] can't find file_offset of VA 0xbf4a20

[?] can't find file_offset of VA 0xbf4bc8

[?] can't find file_offset of VA 0xbf4d70

[?] can't find file_offset of VA 0xbf4f18

[?] can't find file_offset of VA 0xbf50e8

[?] can't find file_offset of VA 0xbf52b8

[?] can't find file_offset of VA 0xbf5488

[?] can't find file_offset of VA 0xbf5658

[?] can't find file_offset of VA 0xbf5828

[?] can't find file_offset of VA 0xbf5910

[?] can't find file_offset of VA 0xbf59f8

[?] can't find file_offset of VA 0xbf5b50

[?] can't find file_offset of VA 0xbf5ca8

[?] can't find file_offset of VA 0xbf5e00

[?] can't find file_offset of VA 0xbf5f58

[?] can't find file_offset of VA 0xbf60b0

[?] can't find file_offset of VA 0xbf6208

[?] can't find file_offset of VA 0xbf6360

[?] can't find file_offset of VA 0xbf64b8

[?] can't find file_offset of VA 0xbf6610

[?] can't find file_offset of VA 0xbf6768

[?] can't find file_offset of VA 0xbf68c0

[?] can't find file_offset of VA 0xbf6a18

[?] can't find file_offset of VA 0xbf6b70

[?] can't find file_offset of VA 0xbf6cc8

[?] can't find file_offset of VA 0xbf6e20

[?] can't find file_offset of VA 0xbf6f78

[?] can't find file_offset of VA 0xbf70d0

[?] can't find file_offset of VA 0xbf7228

[?] can't find file_offset of VA 0xbf7380

[?] can't find file_offset of VA 0xbf74d8

[?] can't find file_offset of VA 0xbf7630

[?] can't find file_offset of VA 0xbf7748

[?] can't find file_offset of VA 0xbf7a10

[?] can't find file_offset of VA 0xbf7a6c

[?] can't find file_offset of VA 0xbf7ac8

[?] can't find file_offset of VA 0xbf7b24

[?] too many errors getting resource data, stopped on 0 of 1

[?] can't find file_offset of VA 0x0