Qnx.6.3.2.3.serials.generator.by.Inferno.exe

info
MZ
PE
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	Qnx.6.3.2.3.serials.generator.by.Inferno.exe
size	198656 (0x30800)
md5	17a5e747b69bf1ad0940387fd00b31a8

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: 07 05 0d 0b 1f fb 05 0d  1f fb 05 0d 1f fb 05 0d  |................|
00000050: 0d 0b 1f 0d 1d fb 05 0d  1f fb 07 0d 07 fb 05 0d  |................|
00000060: 0d 0b 1b 0d 0d fb 05 0d  0d 0d 0b 0d 05 fb 05 0d  |................|
00000070: 0d 0d 05 0d 1d fb 05 0d  0d 0d 0f 0d 1d fb 05 0d  |................|
00000080: 05 07 0b 05 1f fb 05 0d  00 00 00 00 00 00 00 00  |................|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x4f162230
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	81.0
SizeOfCode	0x28000
SizeOfInitializedData	0x8400
SizeOfUninitializedData	0
AddressOfEntryPoint	0xec61
BaseOfCode	0x1000
BaseOfData	0x29000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0x3f000
SizeOfHeaders	0x400
CheckSum	0x32fed
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.qhma	0x1000	0x27fce	0x28000	R-X CODE
.iJwkuN	0x29000	0x8c	0x200	R-- IDATA
.NFX	0x2a000	0x38b	0x400	RW- IDATA
.rvcGbk	0x2b000	0x40	0x200	RW- IDATA
.zoZn	0x2c000	0x5624	0x5800	R-- IDATA
.data	0x32000	0x2274	0x2400	RW- IDATA DISCARDABLE
.lvuFa	0x35000	0x930f	0	R-- IDATA

Data Directory

type	va	size
EXPORT	0x326e0	0x7a
IMPORT	0x29000	0x8c
RESOURCE	0x32a5a	0xee6
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x33940	0x8dc
DEBUG	0x32a3e	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x32650	0x8c
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
GDI32.dll	141	CreateCompatibleDC
GDI32.dll	361	GetNearestPaletteIndex
GDI32.dll	535	WidenPath
GDI32.dll	369	GetPixel
GDI32.dll	146	CreateDIBSection
ADVAPI32.dll	48	ControlService
ADVAPI32.dll	382	RegQueryInfoKeyA
ADVAPI32.dll	153	EqualSid
ADVAPI32.dll	364	RegEnumValueA
USER32.dll	414	IsRectEmpty
USER32.dll	245	GetClassInfoExA
USER32.dll	268	GetDesktopWindow
USER32.dll	159	DispatchMessageA
USER32.dll	562	SetCaretPos
USER32.dll	494	PeekMessageA
USER32.dll	290	GetKeyboardLayout
USER32.dll	602	SetScrollInfo
USER32.dll	499	PostQuitMessage
USER32.dll	247	FindWindowA
USER32.dll	537	ReplyMessage
USER32.dll	549	SendInput
USER32.dll	369	GetWindowPlacement
SHLWAPI.dll	281	StrCmpIW
KERNEL32.dll	194	CopyFileW
KERNEL32.dll	368	FindResourceExA
KERNEL32.dll	180	CompareStringW
KERNEL32.dll	1345	lstrcmpA
KERNEL32.dll	688	HeapLock
KERNEL32.dll	1134	TransactNamedPipe

ord	entry_va	function_name
1	0x1233d	IsNotObjectOriginal@4
2	0x5314	ValidateMutex@8

module_name	Win_Loader_Data_File.uyt
flags	0
timestamp	2012-01-18 01:36:48
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x32710
Functions(2)	0x32770
NameOrdinals(2)	0x32720

show previews

offset	size	type	comment
0	198656	EXE	01/18/2012 01:36:48	#
15c1	15	HTM		#
2eefa	414	BMP	(24 x 5)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find resource section for va=0x32a5a