n-gpp23xr3a.exe

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	n-gpp23xr3a.exe
size	91648 (0x16600)
md5	326cfbd6c91384c35cb402af5fa8e966

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
42	8803	2
18	8444	6
19	8078	153
158	30319	16
155	30319	1
154	30319	1
157	30319	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4ecadf57
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	10.0
SizeOfCode	0x15000
SizeOfInitializedData	0x2000
SizeOfUninitializedData	0x37000
AddressOfEntryPoint	0x4c180
BaseOfCode	0x38000
BaseOfData	0x4d000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x4f000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0x8100
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x37000	0	RWX UDATA
UPX1	0x38000	0x15000	0x14400	RWX IDATA
.rsrc	0x4d000	0x2000	0x1e00	RW- IDATA

Data Directory

type	va	size
EXPORT	0x4ebe8	0x18c
IMPORT	0x4ea5c	0x18c
RESOURCE	0x4d000	0x1a5c
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
CURSOR	#50	308	1252
BITMAP	ABOUT	21720	1252
BITMAP	MAIN	46752	1252
ICON	#1	4264	1252
DIALOG	#1	632	1252
DIALOG	#2	184	1252
DIALOG	#3	160	1252
STRING	#1	560	1252
STRING	#2	832	1252
STRING	#3	684	1252
STRING	#4	120	1252
RCDATA	#1	400	1252
RCDATA	#2	5161	1252
RCDATA	#3	12	1252
RCDATA	#4	128	1252
RCDATA	#5	464	1252
RCDATA	#6	5161	1252
RCDATA	#7	12	1252
RCDATA	#8	3296	1252
RCDATA	#9	36671	1252
RCDATA	#10	34313	1252
RCDATA	#11	48	1252
RCDATA	#12	464	1252
GROUP_CURSOR	#2	20	1252
GROUP_ICON	#500	20	1252
MANIFEST	#1	948	1252

module_name	hint	ord	function_name
advapi32.dll			RegCloseKey
comdlg32.dll			GetOpenFileNameA
gdi32.dll			BitBlt
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			ExitProcess
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			VirtualProtect
shell32.dll			ShellExecuteA
user32.dll			GetDC

ord	entry_va	function_name
1	0x2280	AddMsg
2	0x289c	CloseFileMapping
3	0x2986	CloseFileMapping_readonly
4	0x20cc	GetPatcherWindowHandle
5	0x20e0	GetPluginDataMemory
6	0x6d90	GetRegDword
7	0x6cf0	GetRegString
8	0x2423	LoadFileMapping
9	0xa4e0	Reg_Delete_Value
10	0x6520	SearchAndReplace
11	0xa530	SetRegDword
12	0xa590	SetRegString
13	0x6b3c	write_disk_file

module_name	dup2patcher.exe
flags	0
timestamp	2011-11-21 23:31:35
version	0.0
ordinal_base	1
nFunctions	13
nNames	13
Names(13)	0x4ec44
Functions(13)	0x4ec10
NameOrdinals(13)	0x4ec78

show previews

offset	size	type	comment
0	91648	EXE	11/21/2011 23:31:35	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x225e0

[?] can't find file_offset of VA 0x22714

[?] can't find file_offset of VA 0x27bec

[?] can't find file_offset of VA 0x34334

[?] can't find file_offset of VA 0x345ac

[?] can't find file_offset of VA 0x34664

[?] can't find file_offset of VA 0x34704

[?] can't find file_offset of VA 0x34934

[?] can't find file_offset of VA 0x34c74

[?] can't find file_offset of VA 0x34f20

[?] can't find file_offset of VA 0x34f98

[?] can't find file_offset of VA 0x35128

[?] can't find file_offset of VA 0x36554

[?] can't find file_offset of VA 0x36560

[?] can't find file_offset of VA 0x365e0

[?] can't find file_offset of VA 0x367b0

[?] can't find file_offset of VA 0x37bdc

[?] can't find file_offset of VA 0x37be8

[!] refusing to read CURDIRENTRY beyond resource size