E05B1190D49A763FE86CF981543F8C5923E70C5361CE47FC389A2BF532FE730B.bin

info
MZ
PE
resources
strings
imports
foremost
hexdump
disasm
log
discuss
donate

filename	E05B1190D49A763FE86CF981543F8C5923E70C5361CE47FC389A2BF532FE730B.bin
size	2770944 (0x2a4800)
md5	2905b8cb68ee6bc765c5f33106a097b2

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xc
TimeDateStamp	0x2a425e19
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x54800
SizeOfInitializedData	0x13400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4243b8
BaseOfCode	0x1000
BaseOfData	0x56000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x579000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
	0x1000	0x55000	0x27000	RWX IDATA
	0x56000	0x2000	0xa00	RWX IDATA
	0x58000	0x1000	0	RW-
	0x59000	0x3000	0	RWX IDATA
	0x5c000	0x1000	0	RW-
	0x5d000	0x1000	0	RWX IDATA
	0x5e000	0x7000	0	RWX IDATA
	0x65000	0xa000	0x1000	RWX IDATA
.	0x6f000	0x3000	0x3000	RWX IDATA
	0x72000	0x2a5000	0x18000	RWX IDATA
.0&	0x317000	0x10d000	0x10c200	RWX IDATA
	0x424000	0	0x154800	RWX IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x424000	0x390
RESOURCE	0x6f000	0x2f94
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x54d5e8	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x45c000	0x45c010	0x94d5e0	0x94d5e4	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	PREVIEWGLYPH	232
ICON	#1	16936
DIALOG	DLGTEMPLATE	82
STRING	#4081	252
STRING	#4082	492
STRING	#4083	328
STRING	#4084	628
STRING	#4085	372
STRING	#4086	232
STRING	#4087	340
STRING	#4088	1176
STRING	#4089	852
STRING	#4090	1000
STRING	#4091	564
STRING	#4092	236
STRING	#4093	436
STRING	#4094	996
STRING	#4095	856
STRING	#4096	692
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	648
RCDATA	TFORM1	753
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	MAINICON	20

id	lang	string
65280	0	None
65281	0	Scroll Bar
65282	0	3D Dark Shadow
65283	0	3D Light
65284	0	Window Background
65285	0	Window Frame
65286	0	Window Text
65287	0	No help keyword specified.
65296	0	Button Face
65297	0	Button Highlight
65298	0	Button Shadow
65299	0	Button Text
65300	0	Caption Text
65301	0	Default
65302	0	Gray Text
65303	0	Highlight Background
65304	0	Highlight Text
65305	0	Inactive Border
65306	0	Inactive Caption
65307	0	Inactive Caption Text
65308	0	Info Background
65309	0	Info Text
65310	0	Menu Background
65311	0	Menu Text
65312	0	Silver
65313	0	Red
65314	0	Lime
65315	0	Yellow
65316	0	Blue
65317	0	Fuchsia
65318	0	Aqua
65319	0	White
65320	0	Money Green
65321	0	Sky Blue
65322	0	Cream
65323	0	Medium Gray
65324	0	Active Border
65325	0	Active Caption
65326	0	Application Workspace
65327	0	Background
65328	0	Docked control must have a name
65329	0	Error removing control from dock tree
65330	0	- Dock zone not found
65331	0	- Dock zone has no control
65332	0	Unable to find a Table of Contents
65333	0	No help found for %s
65334	0	No context-sensitive help installed
65335	0	No topic-based help system installed
65336	0	Black
65337	0	Maroon
65338	0	Green
65339	0	Olive
65340	0	Navy
65341	0	Purple
65342	0	Teal
65343	0	Gray
65344	0	PgUp
65345	0	PgDn
65346	0	End
65347	0	Home
65348	0	Left
65349	0	Up
65350	0	Right
65351	0	Down
65352	0	Ins
65353	0	Del
65354	0	Shift+
65355	0	Ctrl+
65356	0	Alt+
65357	0	Unable to insert a line
65358	0	Clipboard does not support Icons
65359	0	Menu '%s' is already being used by another form
65360	0	&Yes
65361	0	&No
65362	0	OK
65363	0	Cancel
65364	0	&Help
65365	0	&Abort
65366	0	&Retry
65367	0	&Ignore
65368	0	&All
65369	0	N&o to All
65370	0	Yes to &All
65371	0	BkSp
65372	0	Tab
65373	0	Esc
65374	0	Enter
65375	0	Space
65376	0	A control cannot have itself as its parent
65377	0	OK
65378	0	Cancel
65379	0	&Yes
65380	0	&No
65381	0	&Help
65382	0	&Close
65383	0	&Ignore
65384	0	&Retry
65385	0	Abort
65386	0	&All
65387	0	Cannot drag a form
65388	0	Warning
65389	0	Error
65390	0	Information
65391	0	Confirm
65392	0	Invalid ImageList Index
65393	0	Failed to read ImageList data from stream
65394	0	Failed to write ImageList data to stream
65395	0	Error creating window device context
65396	0	Error creating window class
65397	0	Cannot focus a disabled or invisible window
65398	0	Control '%s' has no parent window
65399	0	Cannot hide an MDI Child Form
65400	0	Cannot change Visible in OnShow or OnHide
65401	0	Cannot make a visible window modal
65402	0	Menu index out of range
65403	0	Menu inserted twice
65404	0	Sub-menu is not in menu
65405	0	Not enough timers available
65406	0	GroupIndex cannot be less than a previous menu item's GroupIndex
65407	0	Cannot create form. No MDI forms are currently active
65408	0	Stream read error
65409	0	Property is read-only
65410	0	Resource %s not found
65411	0	%s.Seek not implemented
65412	0	Operation not allowed on sorted list
65413	0	%s not in a class registration group
65414	0	Property %s does not exist
65415	0	Stream write error
65416	0	Bitmap image is not valid
65417	0	Icon image is not valid
65418	0	Cannot change the size of an icon
65419	0	Unsupported clipboard format
65420	0	Out of system resources
65421	0	Canvas does not allow drawing
65422	0	Invalid image size
65423	0	Invalid ImageList
65424	0	Class %s not found
65425	0	A class named %s already exists
65426	0	List does not allow duplicates ($0%x)
65427	0	A component named %s already exists
65428	0	String list does not allow duplicates
65429	0	Cannot create file "%s". %s
65430	0	Cannot open file "%s". %s
65431	0	Invalid stream format
65432	0	''%s'' is not a valid component name
65433	0	Invalid property path
65434	0	Invalid property value
65435	0	List capacity out of bounds (%d)
65436	0	List count out of bounds (%d)
65437	0	List index out of bounds (%d)
65438	0	Out of memory while expanding memory stream
65439	0	Error reading %s%s%s: %s
65440	0	Wed
65441	0	Thu
65442	0	Fri
65443	0	Sat
65444	0	Sunday
65445	0	Monday
65446	0	Tuesday
65447	0	Wednesday
65448	0	Thursday
65449	0	Friday
65450	0	Saturday
65451	0	Ancestor for '%s' not found
65452	0	Cannot assign a %s to a %s
65453	0	Bits index out of range
65454	0	Can't write to a read-only resource stream
65455	0	CheckSynchronize called from thread $%x, which is NOT the main thread
65456	0	Dec
65457	0	January
65458	0	February
65459	0	March
65460	0	April
65461	0	May
65462	0	June
65463	0	July
65464	0	August
65465	0	September
65466	0	October
65467	0	November
65468	0	December
65469	0	Sun
65470	0	Mon
65471	0	Tue
65472	0	%s (%s, line %d)
65473	0	Abstract Error
65474	0	Access violation at address %p in module '%s'. %s of address %p
65475	0	System Error. Code: %d. %s
65476	0	A call to an OS function failed
65477	0	Jan
65478	0	Feb
65479	0	Mar
65480	0	Apr
65481	0	May
65482	0	Jun
65483	0	Jul
65484	0	Aug
65485	0	Sep
65486	0	Oct
65487	0	Nov
65488	0	Variant or safe array index out of bounds
65489	0	Variant or safe array is locked
65490	0	Invalid variant type conversion
65491	0	Invalid variant operation
65492	0	Invalid variant operation (%s%.8x) %s
65493	0	Could not convert variant of type (%s) into type (%s)
65494	0	Overflow while converting variant of type (%s) into type (%s)
65495	0	Variant overflow
65496	0	Invalid argument
65497	0	Invalid variant type
65498	0	Operation not supported
65499	0	Unexpected variant error
65500	0	External exception %x
65501	0	Assertion failed
65502	0	Interface not supported
65503	0	Exception in safecall method
65504	0	Floating point underflow
65505	0	Invalid pointer operation
65506	0	Invalid class typecast
65507	0	Access violation at address %p. %s of address %p
65508	0	Access violation
65509	0	Stack overflow
65510	0	Control-C hit
65511	0	Privileged instruction
65512	0	Exception %s in module %s at %p. %s%s
65513	0	Application Error
65514	0	Format '%s' invalid or incompatible with argument
65515	0	No argument for format '%s'
65516	0	Variant method calls not supported
65517	0	Read
65518	0	Write
65519	0	Error creating variant or safe array
65520	0	'%s' is not a valid integer value
65521	0	Out of memory
65522	0	I/O error %d
65523	0	File not found
65524	0	Invalid filename
65525	0	Too many open files
65526	0	File access denied
65527	0	Read beyond end of file
65528	0	Disk full
65529	0	Invalid numeric input
65530	0	Division by zero
65531	0	Range check error
65532	0	Integer overflow
65533	0	Invalid floating point operation
65534	0	Floating point division by zero
65535	0	Floating point overflow

module_name	ord	function_name
kernel32.dll		GetModuleHandleA
kernel32.dll		GetProcAddress
user32.dll		MessageBoxA
advapi32.dll		RegCloseKey
oleaut32.dll		SysFreeString
gdi32.dll		CreateFontA
shell32.dll		ShellExecuteA
version.dll		GetFileVersionInfoA
comctl32.dll		ImageList_SetIconSize
WSOCK32.dll	23
RPCRT4.dll		RpcStringFreeA
WINSPOOL.DRV		OpenPrinterA
comdlg32.dll		GetFileTitleA
ole32.dll		OleIsCurrentClipboard
SHLWAPI.dll		PathIsUNCA
OLEACC.dll		LresultFromObject
oledlg.dll	8

show previews

offset	size	type	comment
0	2770944	EXE	06/19/1992 22:22:17	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x660ac

[?] can't find file_offset of VA 0x661e0

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x66314

[?] can't find file_offset of VA 0x664e4

[?] can't find file_offset of VA 0x666c8

[?] can't find file_offset of VA 0x66898

[?] can't find file_offset of VA 0x66a68

[?] can't find file_offset of VA 0x66c38

[?] can't find file_offset of VA 0x66e08

[?] can't find file_offset of VA 0x66fd8

[?] can't find file_offset of VA 0x671a8

[?] can't find file_offset of VA 0x67378

[?] can't find file_offset of VA 0x67548

[?] can't find file_offset of VA 0x67630

[?] can't find file_offset of VA 0x6b858

[?] can't find file_offset of VA 0x6dd98

[?] can't find file_offset of VA 0x6dda8

[?] can't find file_offset of VA 0x6e030

[?] can't find file_offset of VA 0x6e324

[?] can't find file_offset of VA 0x6e338

[?] can't find file_offset of VA 0x6e34c

[?] can't find file_offset of VA 0x6e360

[?] can't find file_offset of VA 0x6e374

[?] can't find file_offset of VA 0x6e388

[?] can't find file_offset of VA 0x6e39c

[?] can't find file_offset of VA 0x6e3b0