filenameDFLAYOUT.EXE
size39184 (0x9910)
md515c794557cc26d1619cc87e0c4106ebf
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xd0

Rich Header

lib idversiontimes used
10102
19803415
617351
0053

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x35019a6d
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion5.12
SizeOfCode0x5800
SizeOfInitializedData0x5000
SizeOfUninitializedData0
AddressOfEntryPoint0x2800
BaseOfCode0x1000
BaseOfData0x7000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion5.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xc000
SizeOfHeaders0x600
CheckSum0xecd2
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

InstallShield 2000

Sections

namevavsizeraw sizeflags
.text0x10000x57280x5800R-X CODE
.data0x70000x3ef80x2a00RW- IDATA
.rsrc0xb0000xf700x1000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x5dd40xa0
RESOURCE0xb0000xf70
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x11b00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2400xa4
IAT0x10000x1a8
Delay_IAT00
CLR_Header00
typenamesizecp
DIALOG#1013500
STRING#2780
STRING#73220
STRING#135720
STRING#149160
STRING#151340
STRING#19620
ACCELERATORS#133240
VERSION#19280
idlangstring
201033Add File to Optimize
211033dfl
1001033FILTER_BEGIN
1011033All Files (*.*)
1021033*.*
1031033Word Files (*.doc)
1041033*.doc
1051033Excel Files (*.xls)
1061033*.xls
1071033Power Point Files (*.ppt)
1081033*.ppt
1091033Publisher Files (*.pub)
1101033*.pub
1111033FILTER_END
2001033Unable to create main window.
2011033Layout Tool Error
2021033Buffer Too Small. Please select fewer files at a time.
2031033Layout Tool Add Files Error
2041033These files have been successfully optimized.
2051033Compound File Layout Completed
2061033There is not enough memory to complete this operation.
2071033Out of Memory
2081033No temporary path was detected on your machine. Please ensure your temporary path is correctly registered with the system.
2091033No Temporary Path Found
2101033A temporary file could not be created.
2121033An unknown error has occurred.
2131033Layout Tool Error
2141033The file
2151033 could not be found.
2161033 is not a valid Compound File.
2171033 is corrupt!
2181033 has been successfully optimized.
2191033 could not be opened.
2201033Optimizing files...
2211033 could not be renamed.
2221033 has been optimized as
2231033 could not be deleted.
2241033 has read only permissions.
2251033 could not be optimized.
3001033&Optimize
3011033Cancel
module_namehintordfunction_name
KERNEL32.dll355GetTempFileNameA
KERNEL32.dll770lstrcpyA
KERNEL32.dll761lstrcatA
KERNEL32.dll460LocalFree
KERNEL32.dll456LocalAlloc
KERNEL32.dll477MoveFileA
KERNEL32.dll74CreateThread
KERNEL32.dll776lstrlenA
KERNEL32.dll282GetLastError
KERNEL32.dll357GetTempPathA
KERNEL32.dll484MultiByteToWideChar
KERNEL32.dll5AreFileApisANSI
KERNEL32.dll432InterlockedIncrement
KERNEL32.dll429InterlockedDecrement
KERNEL32.dll87DeleteFileA
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll202GetCommandLineA
KERNEL32.dll372GetVersion
KERNEL32.dll125ExitProcess
KERNEL32.dll670TerminateProcess
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll685UnhandledExceptionFilter
KERNEL32.dll292GetModuleFileNameA
KERNEL32.dll178FreeEnvironmentStringsA
KERNEL32.dll179FreeEnvironmentStringsW
KERNEL32.dll262GetEnvironmentStrings
KERNEL32.dll264GetEnvironmentStringsW
KERNEL32.dll722WideCharToMultiByte
KERNEL32.dll191GetCPInfo
KERNEL32.dll185GetACP
KERNEL32.dll305GetOEMCP
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll621SetHandleCount
KERNEL32.dll277GetFileType
KERNEL32.dll85DeleteCriticalSection
KERNEL32.dll250GetCurrentThreadId
KERNEL32.dll677TlsSetValue
KERNEL32.dll674TlsAlloc
KERNEL32.dll625SetLastError
KERNEL32.dll676TlsGetValue
KERNEL32.dll413HeapDestroy
KERNEL32.dll411HeapCreate
KERNEL32.dll703VirtualFree
KERNEL32.dll559RtlUnwind
KERNEL32.dll735WriteFile
KERNEL32.dll409HeapAlloc
KERNEL32.dll415HeapFree
KERNEL32.dll426InitializeCriticalSection
KERNEL32.dll102EnterCriticalSection
KERNEL32.dll449LeaveCriticalSection
KERNEL32.dll373GetVersionExA
KERNEL32.dll447LCMapStringA
KERNEL32.dll448LCMapStringW
KERNEL32.dll339GetStringTypeA
KERNEL32.dll342GetStringTypeW
KERNEL32.dll699VirtualAlloc
KERNEL32.dll318GetProcAddress
KERNEL32.dll450LoadLibraryA
KERNEL32.dll170FlushFileBuffers
KERNEL32.dll27CloseHandle
KERNEL32.dll636SetStdHandle
KERNEL32.dll618SetFilePointer
KERNEL32.dll338GetStdHandle
GDI32.dll366GetTextExtentPoint32A
USER32.dll79CreateDialogParamA
USER32.dll550SetCursor
USER32.dll410LoadCursorA
USER32.dll22CallWindowProcA
USER32.dll406LoadAcceleratorsA
USER32.dll480PostQuitMessage
USER32.dll142DestroyWindow
USER32.dll603SetWindowPos
USER32.dll348GetWindowRect
USER32.dll255GetDesktopWindow
USER32.dll642TranslateMessage
USER32.dll298GetMessageA
USER32.dll457MoveWindow
USER32.dll427LoadStringA
USER32.dll532SendMessageA
USER32.dll515ReleaseDC
USER32.dll149DispatchMessageA
USER32.dll446MessageBoxA
USER32.dll560SetForegroundWindow
USER32.dll183EnableWindow
USER32.dll657UpdateWindow
USER32.dll606SetWindowTextA
USER32.dll392IsDialogMessageA
USER32.dll600SetWindowLongA
USER32.dll258GetDlgItem
USER32.dll253GetDC
ole32.dll83CoUninitialize
ole32.dll45CoInitialize
ole32.dll13CoCreateInstance
SHELL32.dll18DragFinish
SHELL32.dll20DragQueryFileA
SHELL32.dll17DragAcceptFiles
comdlg32.dll4CommDlgExtendedError
comdlg32.dll9GetOpenFileNameA
dflayout.dllStgOpenLayoutDocfile

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft Compound File Layout User Tool for OLE
FileVersion5.00.1767.1
InternalNameDFLAYOUT.EXE
LegalCopyrightCopyright (C) Microsoft Corp. 1981-1998
OriginalFilenameDFLAYOUT.EXE
ProductNameMicrosoft Compound File Layout User Tool for OLE
ProductVersion5.00.1767.1

VS_FIXEDFILEINFO

FileVersion5.0.1767.1
ProductVersion5.0.1767.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
038912EXE03/07/1998 19:05:17#
15c115HTM#
9800272BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x240