plugin.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	plugin.exe
size	1129984 (0x113e00)
md5	0c57deb1baa200435f94c8f14de93868

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x52d5af3f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0xec000
SizeOfInitializedData	0x29000
SizeOfUninitializedData	0xb3c000
AddressOfEntryPoint	0xc28360
BaseOfCode	0xb3d000
BaseOfData	0xc29000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0xc52000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0xb3c000	0	RWX UDATA
UPX1	0xb3d000	0xec000	0xeb600	RWX IDATA
.rsrc	0xc29000	0x29000	0x28400	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xc51040	0x2b0
RESOURCE	0xc29000	0x28040
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xc28510	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x1c8000	0x7e2
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x1028528	0x1028568	0x5b6c0c	0	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
ICON	#1	67624
ICON	#2	4264
ICON	#3	1128
ICON	#4	86490
STRING	#4063	1200
STRING	#4064	668
STRING	#4065	984
STRING	#4066	2200
STRING	#4067	4204
STRING	#4068	2552
STRING	#4069	2196
STRING	#4070	2172
STRING	#4071	1236
STRING	#4072	1124
STRING	#4073	744
STRING	#4074	1156
STRING	#4075	924
STRING	#4076	956
STRING	#4077	772
STRING	#4078	908
STRING	#4079	828
STRING	#4080	828
STRING	#4081	188
STRING	#4082	224
STRING	#4083	1096
STRING	#4084	1060
STRING	#4085	1188
STRING	#4086	660
STRING	#4087	1348
STRING	#4088	956
STRING	#4089	968
STRING	#4090	944
STRING	#4091	204
STRING	#4092	176
STRING	#4093	668
STRING	#4094	972
STRING	#4095	824
STRING	#4096	752
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	3140
RCDATA	PLATFORMTARGETS	2
RCDATA	TFORM7	9891186
RCDATA	TFUNC	271
RCDATA	TPINCIPE	595368
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	MAINICON	62
VERSION	#1	320
MANIFEST	#1	714

module_name	hint	ord	function_name
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			VirtualProtect
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			VirtualFree
KERNEL32.DLL			ExitProcess
advapi32.dll			RegCloseKey
comctl32.dll			ImageList_Add
gdi32.dll			Pie
msimg32.dll			AlphaBlend
msvcrt.dll			memset
ole32.dll			OleDraw
oleaut32.dll			VariantCopy
shell32.dll			ShellExecuteW
user32.dll			GetDC
version.dll			VerQueryValueW

StringTable 040904E4

FileVersion	1.0.0.0
ProductVersion	1.0.0.0

VS_FIXEDFILEINFO

FileVersion	1.0.60409.33681
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x29
FileFlags	0
FileOS	4
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	1129984	EXE	01/14/2014 21:42:23	#
15c1	15	HTM		#
fe40c	86490	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x1f2cc4

[?] can't find file_offset of VA 0x1f2df8

[?] can't find file_offset of VA 0x1f2f2c

[?] can't find file_offset of VA 0x1f3060

[?] can't find file_offset of VA 0x1f3194

[?] can't find file_offset of VA 0x1f32c8

[?] can't find file_offset of VA 0x1f33fc

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x21a444

[?] can't find file_offset of VA 0x21a8f4

[?] can't find file_offset of VA 0x21ab90

[?] can't find file_offset of VA 0x21af68

[?] can't find file_offset of VA 0x21b800

[?] can't find file_offset of VA 0x21c86c

[?] can't find file_offset of VA 0x21d264

[?] can't find file_offset of VA 0x21daf8

[?] can't find file_offset of VA 0x21e374

[?] can't find file_offset of VA 0x21e848

[?] can't find file_offset of VA 0x21ecac

[?] can't find file_offset of VA 0x21ef94

[?] can't find file_offset of VA 0x21f418

[?] can't find file_offset of VA 0x21f7b4

[?] can't find file_offset of VA 0x21fb70

[?] can't find file_offset of VA 0x21fe74

[?] can't find file_offset of VA 0x220200

[?] can't find file_offset of VA 0x22053c

[?] can't find file_offset of VA 0x220878

[?] can't find file_offset of VA 0x220934

[?] can't find file_offset of VA 0x220a14

[?] can't find file_offset of VA 0x220e5c

[?] can't find file_offset of VA 0x221280

[?] can't find file_offset of VA 0x221724

[?] can't find file_offset of VA 0x2219b8

[?] can't find file_offset of VA 0x221efc

[?] can't find file_offset of VA 0x2222b8

[?] can't find file_offset of VA 0x222680

[?] can't find file_offset of VA 0x222a30

[?] can't find file_offset of VA 0x222afc

[?] can't find file_offset of VA 0x222bac

[?] can't find file_offset of VA 0x222e48

[?] can't find file_offset of VA 0x223214

[?] can't find file_offset of VA 0x22354c

[?] can't find file_offset of VA 0x22383c

[?] can't find file_offset of VA 0x22384c

[?] can't find file_offset of VA 0x224490

[?] can't find file_offset of VA 0x224494

[!] refusing to read CURDIRENTRY beyond resource size

[?] can't find file_offset of VA 0x1b6c0c

[?] can't find file_offset of VA 0x1c8000