filenameshooting_已解包.exe
size2468387 (0x25aa23)
md51458ec3271ba6f5b6b2b2f578528b492
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
14729917
10816873
1980226
003
19803415
10196
1181688
617201

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x3a2e957d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x18000
SizeOfInitializedData0xf000
SizeOfUninitializedData0
AddressOfEntryPoint0x13327
BaseOfCode0x1000
BaseOfData0x19000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x28000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Armadillo v4.x

Sections

namevavsizeraw sizeflags
.text0x10000x17abe0x18000R-X CODE
.rdata0x190000x412a0x5000R-- IDATA
.data0x1e0000x74380x3000RW- IDATA
.rsrc0x260000x16580x2000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1bf900xb4
RESOURCE0x260000x1658
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12960
ICON#27440
ICON#32960
ICON#47440
ICON#51200
DIALOG#1058880
DIALOG#10592260
DIALOG#10602540
DIALOG#10611980
DIALOG#10623660
DIALOG#10633660
DIALOG#10644780
DIALOG#10652540
DIALOG#10662540
GROUP_ICON#1055340
GROUP_ICON#1056340
GROUP_ICON#1057200
module_namehintordfunction_name
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLFreeLibrary
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLSleep
KERNEL32.DLLSetErrorMode
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLGetProcAddress
KERNEL32.DLLSuspendThread
KERNEL32.DLLGetSystemDirectoryA
KERNEL32.DLLGetWindowsDirectoryA
KERNEL32.DLLReadFile
KERNEL32.DLLFlushFileBuffers
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLCreateProcessA
KERNEL32.DLLGetFileSize
KERNEL32.DLLMoveFileA
KERNEL32.DLLGetFileAttributesA
KERNEL32.DLLExpandEnvironmentStringsA
KERNEL32.DLLMoveFileExA
KERNEL32.DLLGetProfileStringA
KERNEL32.DLLWritePrivateProfileStringA
KERNEL32.DLLWriteProfileStringA
KERNEL32.DLLGetEnvironmentVariableA
KERNEL32.DLLWriteFile
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLGetLastError
KERNEL32.DLLlstrcpyA
KERNEL32.DLLlstrcatA
KERNEL32.DLLSetCurrentDirectoryA
KERNEL32.DLLRemoveDirectoryA
KERNEL32.DLLDeleteFileA
KERNEL32.DLLGetVersionExA
KERNEL32.DLLCreateThread
KERNEL32.DLLResumeThread
KERNEL32.DLLGetDiskFreeSpaceA
KERNEL32.DLLGetDriveTypeA
KERNEL32.DLLlstrlenA
KERNEL32.DLLCreateFileA
KERNEL32.DLLlstrcpynA
KERNEL32.DLLSetFilePointer
KERNEL32.DLLFileTimeToSystemTime
KERNEL32.DLLCompareFileTime
KERNEL32.DLLSetFileTime
KERNEL32.DLLGetShortPathNameA
KERNEL32.DLLLocalFileTimeToFileTime
KERNEL32.DLLGetLocalTime
KERNEL32.DLLDosDateTimeToFileTime
KERNEL32.DLLFileTimeToLocalFileTime
KERNEL32.DLLlstrcmpA
KERNEL32.DLLlstrcmpiA
KERNEL32.DLLFindFirstFileA
KERNEL32.DLLCreateDirectoryA
KERNEL32.DLLFindNextFileA
KERNEL32.DLLFindClose
KERNEL32.DLLSetFileAttributesA
KERNEL32.DLLGetTempFileNameA
KERNEL32.DLLGetPrivateProfileStringA
KERNEL32.DLLGetExitCodeProcess
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLOpenProcess
KERNEL32.DLLHeapReAlloc
KERNEL32.DLLRtlUnwind
KERNEL32.DLLVirtualFree
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLCloseHandle
KERNEL32.DLLHeapCreate
KERNEL32.DLLHeapDestroy
KERNEL32.DLLGetFileType
KERNEL32.DLLGetStdHandle
KERNEL32.DLLSetHandleCount
KERNEL32.DLLGetEnvironmentStringsW
KERNEL32.DLLGetEnvironmentStrings
KERNEL32.DLLFreeEnvironmentStringsW
KERNEL32.DLLFreeEnvironmentStringsA
KERNEL32.DLLUnhandledExceptionFilter
KERNEL32.DLLTerminateProcess
KERNEL32.DLLHeapFree
KERNEL32.DLLHeapAlloc
KERNEL32.DLLExitProcess
KERNEL32.DLLGetVersion
KERNEL32.DLLGetCommandLineA
KERNEL32.DLLGetStartupInfoA
KERNEL32.DLLGetStringTypeA
KERNEL32.DLLGetStringTypeW
KERNEL32.DLLGetCPInfo
KERNEL32.DLLGetACP
KERNEL32.DLLGetOEMCP
KERNEL32.DLLLCMapStringA
KERNEL32.DLLLCMapStringW
KERNEL32.DLLSetStdHandle
ADVAPI32.dllAdjustTokenPrivileges
ADVAPI32.dllCloseServiceHandle
ADVAPI32.dllOpenSCManagerA
ADVAPI32.dllRegDeleteKeyA
ADVAPI32.dllRegCloseKey
ADVAPI32.dllRegEnumKeyExA
ADVAPI32.dllRegQueryInfoKeyA
ADVAPI32.dllRegOpenKeyExA
ADVAPI32.dllLookupPrivilegeValueA
ADVAPI32.dllOpenProcessToken
ADVAPI32.dllRegSetValueExA
ADVAPI32.dllRegQueryValueExA
ADVAPI32.dllRegCreateKeyExA
ADVAPI32.dllRegEnumValueA
ADVAPI32.dllRegDeleteValueA
GDI32.dllStretchDIBits
GDI32.dllCreatePalette
GDI32.dllCreateSolidBrush
GDI32.dllSelectPalette
GDI32.dllGetTextMetricsA
GDI32.dllSetTextColor
GDI32.dllTextOutA
GDI32.dllSelectObject
GDI32.dllCreateFontIndirectA
GDI32.dllSetTextAlign
GDI32.dllDeleteDC
GDI32.dllBitBlt
GDI32.dllSetBkMode
GDI32.dllCreateRectRgn
GDI32.dllCreateCompatibleBitmap
GDI32.dllSelectClipRgn
GDI32.dllDeleteObject
GDI32.dllRealizePalette
GDI32.dllGetTextExtentPoint32A
GDI32.dllCreateCompatibleDC
ole32.dllCoInitialize
ole32.dllCoUninitialize
ole32.dllCoCreateInstance
OLEAUT32.dll186
OLEAUT32.dll161
OLEAUT32.dll163
OLEAUT32.dll6
SHELL32.dllSHChangeNotify
SHELL32.dllSHBrowseForFolderA
SHELL32.dllShellExecuteA
SHELL32.dllSHGetSpecialFolderLocation
SHELL32.dllSHGetPathFromIDListA
USER32.dllShowWindow
USER32.dllSetCursor
USER32.dllEndDialog
USER32.dllSetWindowTextA
USER32.dllSetDlgItemTextA
USER32.dllGetDlgItem
USER32.dllPostMessageA
USER32.dllIsIconic
USER32.dllDialogBoxParamA
USER32.dllLoadCursorA
USER32.dllInflateRect
USER32.dllCheckDlgButton
USER32.dllSendMessageA
USER32.dllGetDC
USER32.dllReleaseDC
USER32.dllExitWindowsEx
USER32.dllMessageBoxA
USER32.dllwsprintfA
USER32.dllSetTimer
USER32.dllKillTimer
USER32.dllSetForegroundWindow
USER32.dllUnhookWindowsHookEx
USER32.dllEnableWindow
USER32.dllIsDlgButtonChecked
USER32.dllCallNextHookEx
USER32.dllGetFocus
USER32.dllGetForegroundWindow
USER32.dllSetWindowsHookExA
USER32.dllDestroyWindow
USER32.dllSendDlgItemMessageA
USER32.dllBeginPaint
USER32.dllEndPaint
USER32.dllSetFocus
USER32.dllGetDlgItemTextA
USER32.dllDefWindowProcA
USER32.dllScreenToClient
USER32.dllInvalidateRect
USER32.dllGetSysColor
USER32.dllDrawTextA
USER32.dllGetSysColorBrush
USER32.dllUnregisterClassA
USER32.dllFindWindowA
USER32.dllRegisterClassExA
USER32.dllGetSystemMetrics
USER32.dllCreateWindowExA
USER32.dllUpdateWindow
USER32.dllGetMessageA
USER32.dllIsDialogMessageA
USER32.dllTranslateMessage
USER32.dllDispatchMessageA
USER32.dllGetClientRect
USER32.dllPostQuitMessage
USER32.dllDrawIcon
USER32.dllMessageBeep
USER32.dllCreateDialogParamA
USER32.dllLoadIconA
USER32.dllGetWindowRect
USER32.dllFillRect
VERSION.dllGetFileVersionInfoSizeA
VERSION.dllGetFileVersionInfoA
VERSION.dllVerQueryValueA
offsetsizetypecomment
0143360EXE12/06/2000 19:37:33#
15c115HTM#
230002325027BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 2468387 bytes (2411 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK