help.exe - Command Line Help Utility

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	help.exe
size	8704 (0x2200)
md5	0f488c73aa50c2fc1361f19e8fc19926

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
132	30729	1
149	30729	1
147	30729	5
1	0	50
131	30729	20
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4a5bc001
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x1200
SizeOfInitializedData	0xe00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x18ba
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x1000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0x6000
SizeOfHeaders	0x400
CheckSum	0xcdb8
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x11ca	0x1200	R-X CODE
.data	0x3000	0x380	0x200	RW- IDATA
.rsrc	0x4000	0x7e8	0x800	R-- IDATA
.reloc	0x5000	0x1ce	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1da4	0x3c
RESOURCE	0x4000	0x7e8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x5000	0x13c
DEBUG	0x10e0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x11d8	0x40
Bound_IAT	0x270	0x30
IAT	0x1000	0xc0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
MUI	#1	200
VERSION	#1	904
MANIFEST	#1	679

module_name	hint	function_name
KERNEL32.dll	1317	WriteFile
KERNEL32.dll	1297	WideCharToMultiByte
KERNEL32.dll	432	GetConsoleOutputCP
KERNEL32.dll	1316	WriteConsoleW
KERNEL32.dll	428	GetConsoleMode
KERNEL32.dll	499	GetFileType
KERNEL32.dll	612	GetStdHandle
KERNEL32.dll	350	FormatMessageW
KERNEL32.dll	840	LocalFree
KERNEL32.dll	1181	SetThreadUILanguage
KERNEL32.dll	723	HeapSetInformation
KERNEL32.dll	447	GetCurrentProcess
KERNEL32.dll	1212	TerminateProcess
KERNEL32.dll	632	GetSystemTimeAsFileTime
KERNEL32.dll	448	GetCurrentProcessId
KERNEL32.dll	452	GetCurrentThreadId
KERNEL32.dll	658	GetTickCount
KERNEL32.dll	932	QueryPerformanceCounter
KERNEL32.dll	532	GetModuleHandleA
KERNEL32.dll	1185	SetUnhandledExceptionFilter
KERNEL32.dll	744	InterlockedCompareExchange
KERNEL32.dll	1198	Sleep
KERNEL32.dll	747	InterlockedExchange
KERNEL32.dll	1231	UnhandledExceptionFilter
msvcrt.dll	469	_initterm
msvcrt.dll	1167	exit
msvcrt.dll	212	__setusermatherr
msvcrt.dll	185	__p__commode
msvcrt.dll	190	__p__fmode
msvcrt.dll	210	__set_app_type
msvcrt.dll	55	void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	345	_except_handler4_common
msvcrt.dll	295	_controlfp
msvcrt.dll	106	_XcptFilter
msvcrt.dll	354	_exit
msvcrt.dll	276	_cexit
msvcrt.dll	225	__wgetmainargs
msvcrt.dll	1286	setlocale
msvcrt.dll	1017	_wcsnicmp
msvcrt.dll	1365	wcscpy_s
msvcrt.dll	1360	wcscat_s
msvcrt.dll	1122	_wsystem
msvcrt.dll	926	_ultow
msvcrt.dll	1246	malloc
msvcrt.dll	1190	free
msvcrt.dll	257	_amsg_exit

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Command Line Help Utility
FileVersion	6.1.7600.16385 (win7_rtm.090713-1255)
InternalName	Help
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	Help.Exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion	6.1.7600.16385
ProductVersion	6.1.7600.16385
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	8704	EXE	07/13/2009 23:15:13	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x270

help.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

help.exe
-