b.pwc - PACKAGE.EXE - PrismXL Package

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	b.pwc
size	25600 (0x6400)
md5	20cbfa59733ecd9c29737d319094ab87

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
93	2067	3
1	0	1
100	3077	1
94	3052	1
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x4088b301
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x1a00
SizeOfInitializedData	0x6200
SizeOfUninitializedData	0x200
AddressOfEntryPoint	0x8098
BaseOfCode	0x8000
BaseOfData	0x1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xc000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x400
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

NeoLite v2.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x200	0x200	RW- UDATA
.rdata	0x2000	0x200	0x200	R-- IDATA
.rsrc	0x3000	0x4370	0x1800	R-- IDATA
.neolit	0x8000	0x1868	0x1868	RWX CODE
.PTData	0xa000	0x1c00	0x1c00	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x8000	0x3c
RESOURCE	0x3000	0x1800
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x803c	0x10
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
CURSOR	#4	308
CURSOR	#5	180
CURSOR	#6	308
CURSOR	#7	308
CURSOR	#8	308
CURSOR	#9	308
CURSOR	#10	308
CURSOR	#11	308
CURSOR	#12	308
CURSOR	#13	308
CURSOR	#14	308
CURSOR	#15	308
CURSOR	#16	308
CURSOR	#17	308
CURSOR	#18	308
CURSOR	#19	308
BITMAP	#30994	184
BITMAP	#30996	324
ICON	#1	744
ICON	#2	296
ICON	#3	1640
STRING	#3841	130
STRING	#3842	42
STRING	#3843	402
STRING	#3857	1250
STRING	#3858	794
STRING	#3859	732
STRING	#3865	172
STRING	#3867	1220
STRING	#3868	612
STRING	#3887	66
GROUP_CURSOR	#30977	34
GROUP_CURSOR	#30998	20
GROUP_CURSOR	#30999	20
GROUP_CURSOR	#31000	20
GROUP_CURSOR	#31001	20
GROUP_CURSOR	#31002	20
GROUP_CURSOR	#31003	20
GROUP_CURSOR	#31004	20
GROUP_CURSOR	#31005	20
GROUP_CURSOR	#31006	20
GROUP_CURSOR	#31007	20
GROUP_CURSOR	#31008	20
GROUP_CURSOR	#31009	20
GROUP_CURSOR	#31010	20
GROUP_CURSOR	#31011	20
GROUP_ICON	#1	48
VERSION	#1	816

module_name	hint	function_name
USER32.dll	478	MessageBoxA
kernel32.dll	398	LoadLibraryA
kernel32.dll	277	GetProcAddress

StringTable 040904b0

CompanyName	New Boundary Technologies, Inc.
FileDescription	PrismXL Package
FileVersion	6.0.0.228
InternalName	PrismXL Package
LegalCopyright	© 1997-2004 New Boundary Technologies
OriginalFilename	PACKAGE.EXE
ProductName	PrismXL Software Family
ProductVersion	6.0.0.228

VS_FIXEDFILEINFO

FileVersion	6.0.0.228
ProductVersion	6.0.0.228
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	25600	EXE	04/23/2004 06:09:05	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x48cc

[?] can't find file_offset of VA 0x49a4

[?] can't find file_offset of VA 0x4aec

[?] can't find file_offset of VA 0x4c34

[?] can't find file_offset of VA 0x4d7c

[?] can't find file_offset of VA 0x4ec4

[?] can't find file_offset of VA 0x500c

[?] can't find file_offset of VA 0x5154

[?] can't find file_offset of VA 0x529c

[?] can't find file_offset of VA 0x53e4

[?] can't find file_offset of VA 0x552c

[?] can't find file_offset of VA 0x5674

[?] can't find file_offset of VA 0x57bc

[?] can't find file_offset of VA 0x5904

[?] can't find file_offset of VA 0x5a4c

[?] can't find file_offset of VA 0x5b94

[?] can't find file_offset of VA 0x5c4c

[?] can't find file_offset of VA 0x5d90

[?] can't find file_offset of VA 0x5e14

[?] can't find file_offset of VA 0x5e40

[?] can't find file_offset of VA 0x5fd4

[?] can't find file_offset of VA 0x6840

[?] can't find file_offset of VA 0x6564

[?] can't find file_offset of VA 0x64b8

[?] can't find file_offset of VA 0x6b5c

[?] can't find file_offset of VA 0x7020

[?] can't find file_offset of VA 0x7284

[?] can't find file_offset of VA 0x4980

[?] can't find file_offset of VA 0x5140

[?] can't find file_offset of VA 0x4ad8

[?] can't find file_offset of VA 0x4ff8

[?] can't find file_offset of VA 0x4eb0

[?] can't find file_offset of VA 0x57a8

[?] can't find file_offset of VA 0x4d68

[?] can't find file_offset of VA 0x53d0

[?] can't find file_offset of VA 0x4c20

[?] can't find file_offset of VA 0x5288

[?] can't find file_offset of VA 0x5518

[?] can't find file_offset of VA 0x5660

[?] can't find file_offset of VA 0x58f0

[?] can't find file_offset of VA 0x5a38

[?] can't find file_offset of VA 0x5b80

b.pwc-