agivenlike.exe

info
MZ
PE
resources
strings
imports
foremost
hexdump
disasm
log
discuss
donate

filename	agivenlike.exe
size	151552 (0x25000)
md5	2e05b5f8b231b29167532a02139e224c

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
11	9782	10
14	7299	22
10	9782	83
93	4035	9
1	0	94
11	8168	42
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x19c764f
PointerToSymbolTable	0x74
NumberOfSymbols	0x1010101
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0xe000
SizeOfInitializedData	0x16000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x58ba
BaseOfCode	0x1000
BaseOfData	0xf000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x27000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	1
SizeOfStackReserve	0x10000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x100
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Armadillo v4.x

Sections

name	va	vsize	raw size	flags
.tet	0x1000	0xd20e	0xe000	R-X
.rdata	0xf000	0x1cff	0x2000	R-- IDATA
.datae	0x11000	0x4201	0x3000	RW- IDATA
rsrc	0x16000	0x10b28	0x11000	R-- IDATA

Data Directory

type	va	size
EXPORT	0x100	0x10100
IMPORT	0x10010	0x10001
RESOURCE	0x16000	0x10b01
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0x100
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0x1000000
IAT	0xf000	0x1ff
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MENU	#109	588	1252
DIALOG	#103	234	1252
STRING	#7	48	1252
ACCELERATORS	#109	64	1252
RCDATA	#81	67080	1252

id	lang	string
103	2052	TCAD
109	2052	TCAD

module_name	hint	function_name
KERNEL32.dll	580	LCMapStringA
KERNEL32.dll	445	GetStringTypeW
KERNEL32.dll	442	GetStringTypeA
KERNEL32.dll	629	MultiByteToWideChar
KERNEL32.dll	403	GetOEMCP
KERNEL32.dll	253	GetACP
KERNEL32.dll	260	GetCPInfo
KERNEL32.dll	560	IsBadCodePtr
KERNEL32.dll	563	IsBadReadPtr
KERNEL32.dll	566	IsBadWritePtr
KERNEL32.dll	897	VirtualAlloc
KERNEL32.dll	784	SetEndOfFile
KERNEL32.dll	581	LCMapStringW
KERNEL32.dll	238	FlushFileBuffers
KERNEL32.dll	899	VirtualFree
KERNEL32.dll	530	HeapCreate
KERNEL32.dll	532	HeapDestroy
KERNEL32.dll	489	GetVersionExA
KERNEL32.dll	344	GetEnvironmentVariableA
KERNEL32.dll	343	GetEnvironmentStringsW
KERNEL32.dll	341	GetEnvironmentStrings
KERNEL32.dll	916	WideCharToMultiByte
KERNEL32.dll	247	FreeEnvironmentStringsW
KERNEL32.dll	246	FreeEnvironmentStringsA
KERNEL32.dll	381	GetModuleFileNameA
KERNEL32.dll	382	GetModuleFileNameW
KERNEL32.dll	86	CreateFileW
KERNEL32.dll	323	GetCurrentProcessId
KERNEL32.dll	646	OpenProcess
KERNEL32.dll	594	LoadLibraryA
KERNEL32.dll	416	GetProcAddress
KERNEL32.dll	355	GetFileSize
KERNEL32.dll	693	ReadFile
KERNEL32.dll	823	SetStdHandle
KERNEL32.dll	52	CloseHandle
KERNEL32.dll	878	UnhandledExceptionFilter
KERNEL32.dll	540	HeapSize
KERNEL32.dll	727	RtlUnwind
KERNEL32.dll	679	RaiseException
KERNEL32.dll	383	GetModuleHandleA
KERNEL32.dll	439	GetStartupInfoA
KERNEL32.dll	272	GetCommandLineA
KERNEL32.dll	488	GetVersion
KERNEL32.dll	185	ExitProcess
KERNEL32.dll	369	GetLastError
KERNEL32.dll	932	WriteFile
KERNEL32.dll	795	SetFilePointer
KERNEL32.dll	804	SetHandleCount
KERNEL32.dll	441	GetStdHandle
KERNEL32.dll	358	GetFileType
KERNEL32.dll	862	TerminateProcess
KERNEL32.dll	322	GetCurrentProcess
KERNEL32.dll	83	CreateFileA
KERNEL32.dll	534	HeapFree
KERNEL32.dll	528	HeapAlloc
KERNEL32.dll	842	SetUnhandledExceptionFilter
KERNEL32.dll	538	HeapReAlloc
USER32.dll	314	GetMessageA
USER32.dll	679	TranslateAcceleratorA
USER32.dll	682	TranslateMessage
USER32.dll	161	DispatchMessageA
USER32.dll	96	CreateWindowExA
USER32.dll	700	UpdateWindow
USER32.dll	446	LoadIconA
USER32.dll	442	LoadCursorA
USER32.dll	535	RegisterClassExA
USER32.dll	438	LoadAcceleratorsA
USER32.dll	658	ShowWindow
USER32.dll	300	GetMenu
USER32.dll	194	EnableMenuItem
USER32.dll	13	BeginPaint
USER32.dll	200	EndPaint
USER32.dll	153	DestroyWindow
USER32.dll	158	DialogBoxParamA
USER32.dll	198	EndDialog
USER32.dll	516	PostQuitMessage
USER32.dll	403	InvalidateRect
USER32.dll	142	DefWindowProcA
USER32.dll	514	PostMessageA
USER32.dll	268	GetDC
USER32.dll	554	ReleaseDC
USER32.dll	479	MessageBoxA
GDI32.dll	465	MoveToEx
GDI32.dll	461	LineTo
GDI32.dll	148	Ellipse
GDI32.dll	565	SetROP2
GDI32.dll	332	GetBkColor
GDI32.dll	71	CreatePen
GDI32.dll	526	SelectObject
GDI32.dll	421	GetStockObject
GDI32.dll	143	DeleteObject
GDI32.dll	502	Rectangle
PSAPI.DLL	15	GetModuleFileNameExW

show previews

offset	size	type	comment
0	151552	EXE	11/09/1970 20:38:39	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x100

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x100