filename | krnl386.exe | |
---|---|---|
size | 92448 (0x16920) | |
md5 | 32db13a9add714a2936ccfec35dce3ec | |
type | MS-DOS executable, NE for MS Windows 3.x (DLL or font) | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x120 |
blocks_in_file | 0xb5 |
num_relocs | 0 |
header_paragraphs | 0x20 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0 |
ss | 0xe |
sp | 0x80 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 1 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0x400 |
DOS stub
00000000: 0e 1f be 60 01 81 c6 ff 01 81 e6 00 fe 2e 81 3c |...`...........<| 00000010: 4e 45 74 03 e9 8d 00 8c d8 fa 8e d0 8b e6 fb 8b |NEt.............| 00000020: 5c 0e 4b 7c 25 d1 e3 d1 e3 d1 e3 03 5c 22 8b 00 |\.K|%.......\"..| 00000030: 83 7c 32 00 75 05 c7 44 32 09 00 8b 4c 32 83 e9 |.|2.u..D2...L2..| 00000040: 04 d3 e0 8c cf 83 ef 20 03 f8 51 2e 8b 5c 16 4b |....... ..Q..\.K| 00000050: 7c 52 d1 e3 d1 e3 d1 e3 2e 03 5c 22 2e 8b 00 2e ||R........\"....| 00000060: 8b 4c 32 83 e9 04 d3 e0 5b 8c ca 83 ea 20 03 d0 |.L2.....[.... ..| 00000070: 52 2e ff 74 14 8e df 8b ce 81 c1 00 02 eb 21 00 |R..t..........!.| 00000080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000000a0: b8 4f 4b cb e8 1e 00 4b 45 52 4e 53 54 55 42 3a |.OK....KERNSTUB:| 000000b0: 20 45 72 72 6f 72 20 64 75 72 69 6e 67 20 62 6f | Error during bo| 000000c0: 6f 74 0d 0a 24 5a 0e 1f b4 09 cd 21 b8 01 4c cd |ot..$Z.....!..L.| 000000d0: 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |!...............| 000000e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000200:
NE Header
ne_magic | NE |
ne_ver | 5 |
ne_rev | 0x3c |
ne_enttab | 0x89 |
ne_cbenttab | 0x846 |
ne_crc | 0 |
ne_flags | 0x8309 |
ne_autodata | 4 |
ne_heap | 0x200 |
ne_stack | 0 |
ne_csip | 0x1c03b |
ne_sssp | 0 |
ne_cseg | 4 |
ne_cmod | 0 |
ne_cbnrestab | 0x1337 |
ne_segtab | 0x40 |
ne_rsrctab | 0x60 |
ne_restab | 0x78 |
ne_modtab | 0x89 |
ne_imptab | 0x89 |
ne_nrestab | 0xccf |
ne_cmovent | 0xa4 |
ne_align | 4 |
ne_cres | 0 |
ne_exetyp | 2 |
ne_flagsothers | 8 |
ne_pretthunks | 0x202 |
ne_psegrefbytes | 0x1472 |
ne_swaparea | 0 |
ne_expver | 0x30a |
ord | segment | offset | function_name |
---|---|---|---|
342 | 4 | 0x1424 | __GP |
103 | 1 | 0xadfd | NETBIOSCALL |
108 | 1 | 0x4c13 | SWITCHSTACKTO |
213 | 2 | 0x3979 | K213 |
418 | 2 | 0x3b33 | GETPRIVATEPROFILESECTION |
69 | 1 | 0x96 | FINDATOM |
17 | 1 | 0x3adf | GLOBALFREE |
210 | 2 | 0x395f | K210 |
578 | 0xfe | 0 | __MOD_SHELL |
226 | 2 | 0x1b26 | REGSETVALUEEX |
230 | 1 | 0x4909 | GLOBALSMARTPAGELOCK |
211 | 2 | 0x396c | K211 |
1 | 1 | 0xaa6e | FATALEXIT |
222 | 2 | 0x1a7b | REGDELETEVALUE |
163 | 1 | 0x3bd0 | GLOBALLRUOLDEST |
193 | 0xfe | 0x40 | __0040H |
168 | 1 | 0x9a68 | DIRECTRESALLOC |
102 | 1 | 0x5741 | DOS3CALL |
347 | 1 | 0x8804 | ISBADHUGEWRITEPTR |
52 | 3 | 0x75d | FREEPROCINSTANCE |
176 | 1 | 0x3990 | FREESELECTOR |
237 | 2 | 0x3a97 | K237 |
275 | 1 | 0xb3d8 | GETSYSTEMDEFAULTLANGID |
178 | 0xfe | 1 | __WINFLAGS |
53 | 1 | 0x1125 | CALLPROCINSTANCE |
132 | 3 | 0x4b | GETWINFLAGS |
421 | 2 | 0x3b5a | SETFILEATTRIBUTES |
318 | 1 | 0xaeb3 | FATALEXITHOOK |
420 | 2 | 0x3b4d | GETFILEATTRIBUTES |
130 | 3 | 0xde | FILECDR |
214 | 2 | 0x3986 | K214 |
124 | 1 | 0xacdd | ENABLEKERNEL |
9 | 1 | 0x3e55 | LOCALUNLOCK |
515 | 1 | 0xb4dc | GETPROCADDRESS32W |
38 | 1 | 0x342 | SETTASKSIGNALPROC |
512 | 1 | 0x30df | WOWQUERYDEBUG |
219 | 2 | 0x1a00 | REGDELETEKEY |
215 | 2 | 0x3993 | K215 |
184 | 1 | 0x4e81 | GLOBALDOSALLOC |
205 | 1 | 0x135c | CVWBREAK |
125 | 1 | 0xacde | DISABLEKERNEL |
353 | 1 | 0x25bb | LSTRCPYN |
183 | 0xfe | 0 | __0000H |
179 | 0xfe | 0xd000 | __D000H |
167 | 1 | 0x228a | GETEXPWINVER |
197 | 1 | 0x3c23 | GLOBALFIX |
156 | 1 | 0x84d8 | LIMITEMSPAGES |
319 | 1 | 0x8c0a | FLUSHCACHEDFILEHANDLE |
217 | 2 | 0x19ae | REGOPENKEY |
354 | 1 | 0xaecf | GETAPPCOMPATFLAGS |
73 | 1 | 0x3a95 | GETATOMHANDLE |
544 | 1 | 0x31f4 | WOWSETCOMPATHANDLE |
228 | 2 | 0x3a63 | K228 |
208 | 2 | 0x3945 | K208 |
144 | 2 | 0x3904 | CREATEDIRECTORY |
54 | 2 | 0x18f3 | GETINSTANCEDATA |
110 | 1 | 0x9680 | PATCHCODEHANDLE |
504 | 1 | 0xb40c | WOWLOADMODULE |
229 | 2 | 0x3a70 | K229 |
209 | 2 | 0x3952 | K209 |
59 | 1 | 0x3ffb | WRITEPROFILESTRING |
18 | 1 | 0x3b10 | GLOBALLOCK |
170 | 1 | 0x3968 | ALLOCCSTODSALIAS |
508 | 1 | 0xb245 | WOWFAILEDEXEC |
95 | 2 | 0x1907 | LOADLIBRARY |
509 | 1 | 0xb252 | WOWCLOSECOMPORT |
221 | 2 | 0x1a52 | REGSETVALUE |
107 | 3 | 0x7ca | SETERRORMODE |
517 | 1 | 0xb5ed | CALLPROC32W |
173 | 0xfe | 0xf000 | __ROMBIOS |
92 | 3 | 0x38e | GETTEMPDRIVE |
30 | 1 | 0xb578 | WAITEVENT |
104 | 1 | 0x3c73 | GETCODEINFO |
10 | 1 | 0x3e41 | LOCALSIZE |
341 | 3 | 0xa2 | TOOLHELPHOOK |
136 | 1 | 0xb4b5 | GETDRIVETYPE |
323 | 2 | 0x111b | ISROMMODULE |
137 | 1 | 0x3aa9 | FATALAPPEXIT |
14 | 2 | 0x1952 | LOCALNOTIFY |
491 | 2 | 0x3cc6 | REGISTERSERVICEPROCESS |
225 | 2 | 0x1ae5 | REGQUERYVALUEEX |
580 | 0xfe | 0 | __MOD_TOOLHELP |
96 | 2 | 0x1830 | FREELIBRARY |
134 | 3 | 0x6ec | GETWINDOWSDIRECTORY |
204 | 3 | 0x7e6 | SWAPRECORDING |
516 | 1 | 0xb4e9 | GETVDMPOINTER32W |
231 | 1 | 0x4922 | GLOBALSMARTPAGEUNLOCK |
199 | 1 | 0x3edf | SETHANDLECOUNT |
432 | 2 | 0x3b81 | FILETIMETOLOCALFILETIME |
263 | 1 | 0xb308 | WOWMSGBOX |
115 | 1 | 0x15f6 | OUTPUTDEBUGSTRING |
111 | 1 | 0x3b94 | GLOBALWIRE |
571 | 0xfe | 0 | __MOD_DKERNEL |
577 | 0xfe | 0 | __MOD_SOUND |
346 | 1 | 0x87c4 | ISBADHUGEREADPTR |
100 | 2 | 0x32ec | VALIDATECODESEGMENTS |
164 | 1 | 0x3bbc | GLOBALLRUNEWEST |
84 | 1 | 0x3d50 | _LLSEEK |
505 | 1 | 0xb426 | WOWQUERYPERFORMANCECOUNTER |
234 | 2 | 0x1b95 | REGSAVEKEY |
502 | 1 | 0xb3f2 | WOWGETNEXTVDMCOMMAND |
191 | 1 | 0x3bfb | GLOBALPAGELOCK |
31 | 1 | 0xb56b | POSTEVENT |
71 | 1 | 0x3a51 | DELETEATOM |
122 | 1 | 0x577 | ISTASKLOCKED |
133 | 1 | 0x2200 | GETEXEPTR |
50 | 2 | 0x1844 | GETPROCADDRESS |
146 | 2 | 0x391e | DELETEFILE |
29 | 1 | 0xb503 | YIELD |
131 | 3 | 0x8ee | GETDOSENVIRONMENT |
20 | 1 | 0x3b4f | GLOBALSIZE |
216 | 2 | 0x1991 | REGENUMKEY |
143 | 2 | 0x38f7 | GETPRIVATEPROFILESECTIONNAMES |
414 | 2 | 0x3aff | FINDNEXTFILE |
57 | 1 | 0x3efb | GETPROFILEINT |
49 | 2 | 0x188c | GETMODULEFILENAME |
51 | 3 | 0x740 | MAKEPROCINSTANCE |
218 | 2 | 0x19d7 | REGCREATEKEY |
352 | 1 | 0x25c6 | LSTRCATN |
233 | 2 | 0x1b78 | REGUNLOADKEY |
175 | 1 | 0x574d | ALLOCSELECTOR |
422 | 2 | 0x3b67 | GETDISKFREESPACE |
224 | 2 | 0x1a1d | REGQUERYVALUE |
190 | 0xfe | 0xe000 | __E000H |
174 | 0xfe | 0xa000 | __A000H |
64 | 1 | 0x39d8 | ACCESSRESOURCE |
26 | 1 | 0x47bc | GLOBALFREEALL |
67 | 3 | 0x6c6 | SETRESOURCEHANDLER |
188 | 1 | 0x61de | GETSELECTORLIMIT |
189 | 1 | 0x61f6 | SETSELECTORLIMIT |
172 | 1 | 0x5c76 | ALLOCALIAS |
21 | 1 | 0x3afc | GLOBALHANDLE |
117 | 1 | 0xb510 | OLDYIELD |
22 | 1 | 0x3b80 | GLOBALFLAGS |
101 | 1 | 0x573b | NOHOOKDOSCALL |
93 | 1 | 0x10f8 | GETCODEHANDLE |
27 | 2 | 0x18c3 | GETMODULENAME |
220 | 2 | 0x39d4 | REGCLOSEKEY |
145 | 2 | 0x3911 | REMOVEDIRECTORY |
337 | 1 | 0x886d | ISBADSTRINGPTR |
76 | 3 | 0x33c | DELETEPATHNAME |
65 | 1 | 0x3a37 | SIZEOFRESOURCE |
355 | 1 | 0xaf7a | GETWINDEBUGINFO |
356 | 1 | 0xaf86 | SETWINDEBUGINFO |
232 | 2 | 0x1b4f | REGLOADKEY |
75 | 3 | 0x344 | OPENPATHNAME |
68 | 3 | 0 | INITATOMTABLE |
45 | 2 | 0x191e | LOADMODULE |
314 | 1 | 0x13b1 | DEBUGDEFINESEGMENT |
28 | 1 | 0x4bdd | GLOBALMASTERHANDLE |
4 | 2 | 0x3179 | LOCALINIT |
227 | 2 | 0x3a56 | REGFLUSHKEY |
235 | 2 | 0x3a7d | INVALIDATENLSCACHE |
2 | 1 | 0x987a | EXITKERNEL |
201 | 1 | 0x180f | REPLACEINST |
165 | 1 | 0xadf0 | A20PROC |
325 | 1 | 0xab0b | LOGPARAMERROR |
121 | 1 | 0xa388 | LOCALSHRINK |
3 | 1 | 0x57a | GETVERSION |
91 | 2 | 0x2f54 | INITTASK |
521 | 1 | 0xaf27 | GETWOWCOMPATFLAGSEX |
345 | 1 | 0x8958 | ISSHAREDSELECTOR |
83 | 1 | 0x3d25 | _LCREAT |
70 | 1 | 0x93 | ADDATOM |
412 | 2 | 0x3ae5 | SETCURRENTDIRECTORY |
16 | 1 | 0x3b24 | GLOBALREALLOC |
338 | 1 | 0x8891 | HASGPHANDLER |
55 | 3 | 0x90e | CATCH |
15 | 1 | 0x3ac3 | GLOBALALLOC |
88 | 1 | 0x263a | LSTRCPY |
138 | 2 | 0x10cd | GETHEAPSPACES |
74 | 1 | 0x3e7d | OPENFILE |
207 | 1 | 0x275a | ISDBCSLEADBYTE |
180 | 1 | 0x6108 | LONGPTRADD |
192 | 1 | 0x3c0f | GLOBALPAGEUNLOCK |
47 | 2 | 0x1861 | GETMODULEHANDLE |
573 | 0xfe | 0 | __MOD_DUSER |
506 | 1 | 0x2bb6 | WOW16CALL |
112 | 1 | 0x3ba8 | GLOBALUNWIRE |
89 | 1 | 0x264d | LSTRCAT |
627 | 1 | 0x8727 | ISBADFLATREADWRITEPTR |
114 | 0xfe | 8 | __AHINCR |
109 | 1 | 0x4ccd | SWITCHSTACKBACK |
147 | 2 | 0x392b | SETLASTERROR |
187 | 1 | 0x61bd | SETSELECTORBASE |
519 | 1 | 0xb5b9 | EXITKERNELTHUNK |
182 | 0xfe | 0xb800 | __B800H |
575 | 0xfe | 0 | __MOD_DGDI |
129 | 1 | 0x402d | WRITEPRIVATEPROFILESTRING |
194 | 0xfe | 0xf000 | __F000H |
181 | 0xfe | 0xb000 | __B000H |
23 | 1 | 0x3c4b | LOCKSEGMENT |
34 | 1 | 0x360 | SETTASKQUEUE |
186 | 1 | 0x5cfa | GETSELECTORBASE |
158 | 1 | 0x36d | ISWINOLDAPTASK |
162 | 2 | 0x32c3 | LOCALHEAPSIZE |
81 | 1 | 0x3d06 | _LCLOSE |
123 | 1 | 0x84de | KBDRST |
415 | 2 | 0x3b0c | FINDCLOSE |
324 | 1 | 0xaae8 | LOGERROR |
202 | 3 | 0x73 | REGISTERPTRACE |
154 | 1 | 0x3be4 | GLOBALNOTIFY |
99 | 1 | 0x44b5 | GETLPERRMODE |
126 | 1 | 0x6aa4 | MEMORYFREED |
90 | 1 | 0x2592 | LSTRLEN |
32 | 1 | 0xb585 | SETPRIORITY |
36 | 1 | 0x99dc | GETCURRENTTASK |
507 | 1 | 0xb238 | WOWCURSORICONOP |
326 | 2 | 0x1120 | ISROMFILE |
116 | 2 | 0x304d | INITLIB |
206 | 1 | 0x585b | ALLOCSELECTORARRAY |
513 | 1 | 0xb4c2 | LOADLIBRARYEX32W |
349 | 1 | 0x8a0c | _HREAD |
82 | 1 | 0x3d7e | _LREAD |
223 | 2 | 0x1a98 | REGENUMVALUE |
407 | 2 | 0x3acb | GETPRIVATEPROFILESTRUCT |
19 | 1 | 0x3b63 | GLOBALUNLOCK |
514 | 1 | 0xb4cf | FREELIBRARY32W |
127 | 1 | 0x3f6f | GETPRIVATEPROFILEINT |
360 | 2 | 0x3aa4 | OPENFILEEX |
583 | 0xfe | 0 | __MOD_WINNLS |
251 | 1 | 0xb3ff | WOWREGISTERSHELLWINDOWHANDLE |
198 | 1 | 0x3c37 | GLOBALUNFIX |
7 | 1 | 0x3df7 | LOCALFREE |
315 | 1 | 0xb5ac | WRITEOUTPROFILES |
152 | 3 | 0x902 | GETNUMTASKS |
545 | 1 | 0x8adc | TELLKRNLWHONETDRVIS |
511 | 1 | 0xb45a | WOWKILLREMOTETASK |
166 | 2 | 0x1969 | WINEXEC |
8 | 1 | 0x3e0b | LOCALLOCK |
350 | 1 | 0x8a5f | _HWRITE |
86 | 1 | 0x3dae | _LWRITE |
113 | 0xfe | 3 | __AHSHIFT |
576 | 0xfe | 0 | __MOD_KEYBOARD |
24 | 1 | 0x3c5f | UNLOCKSEGMENT |
6 | 1 | 0x3e1f | LOCALREALLOC |
128 | 1 | 0x3fa1 | GETPRIVATEPROFILESTRING |
106 | 1 | 0x6adb | SETSWAPAREASIZE |
570 | 0xfe | 0 | __MOD_KERNEL |
310 | 2 | 0x32ce | LOCALHANDLEDELTA |
42 | 1 | 0xacdc | DISABLEDOS |
161 | 2 | 0x328b | LOCALCOUNTFREE |
177 | 1 | 0x39a4 | PRESTOCHANGOSELECTOR |
135 | 3 | 0x716 | GETSYSTEMDIRECTORY |
148 | 2 | 0x3938 | GETLASTERROR |
574 | 0xfe | 0 | __MOD_GDI |
25 | 1 | 0x4b52 | GLOBALCOMPACT |
579 | 0xfe | 0 | __MOD_WINSOCK |
203 | 1 | 0xaa87 | DEBUGBREAK |
97 | 3 | 0x774 | GETTEMPFILENAME |
584 | 0xfe | 0 | __MOD_WIFEMAN |
252 | 1 | 0xb3b1 | WOWSHUTDOWNTIMER |
200 | 1 | 0x7cbe | VALIDATEFREESPACES |
120 | 1 | 0x8c9e | UNDEFDYNLINK |
72 | 1 | 0x3a65 | GETATOMNAME |
157 | 1 | 0x84df | GETCURPID |
262 | 1 | 0xb2fb | WOWWAITFORMSGANDEVENT |
35 | 1 | 0x31a | GETTASKQUEUE |
155 | 1 | 0x4bec | GETTASKDS |
510 | 1 | 0xb6ae | KDDBGOUT |
63 | 1 | 0x3a0f | FREERESOURCE |
149 | 2 | 0x38ea | GETVERSIONEX |
348 | 1 | 0x897c | HMEMCPY |
311 | 1 | 0xae93 | GETSETKERNELDOSPROC |
41 | 1 | 0xacdb | ENABLEDOS |
56 | 3 | 0x948 | THROW |
416 | 2 | 0x3b19 | WRITEPRIVATEPROFILESECTION |
413 | 2 | 0x3af2 | FINDFIRSTFILE |
185 | 1 | 0x4ebb | GLOBALDOSFREE |
518 | 1 | 0xb692 | _CALLPROCEX32W |
85 | 1 | 0x3cdb | _LOPEN |
572 | 0xfe | 0 | __MOD_USER |
406 | 2 | 0x3abe | WRITEPRIVATEPROFILESTRUCT |
169 | 1 | 0x3c9c | GETFREESPACE |
5 | 1 | 0x3ddb | LOCALALLOC |
582 | 0xfe | 0 | __MOD_COMMDLG |
12 | 1 | 0x3e69 | LOCALFLAGS |
37 | 3 | 0x124 | GETCURRENTPDB |
335 | 1 | 0x8705 | ISBADWRITEPTR |
411 | 2 | 0x3ad8 | GETCURRENTDIRECTORY |
150 | 1 | 0xb592 | DIRECTEDYIELD |
66 | 1 | 0x39f5 | ALLOCRESOURCE |
581 | 0xfe | 0 | __MOD_MMEDIA |
195 | 0xfe | 0xc000 | __C000H |
119 | 1 | 0x332 | GETTASKQUEUEES |
62 | 1 | 0x3a23 | LOCKRESOURCE |
196 | 1 | 0x6211 | SELECTORACCESSRIGHTS |
48 | 2 | 0x1878 | GETMODULEUSAGE |
351 | 1 | 0x3579 | BUNNY_351 |
334 | 1 | 0x86e4 | ISBADREADPTR |
336 | 1 | 0x8847 | ISBADCODEPTR |
61 | 1 | 0x39be | LOADRESOURCE |
13 | 1 | 0xa35d | LOCALCOMPACT |
320 | 1 | 0x372 | ISTASK |
332 | 4 | 0x218 | THHOOK |
58 | 1 | 0x3f21 | GETPROFILESTRING |
142 | 3 | 0x5f2 | GETPROFILESECTIONNAMES |
98 | 1 | 0x2185 | GETLASTDISKCHANGE |
419 | 2 | 0x3b40 | GETPROFILESECTION |
171 | 1 | 0x397c | ALLOCDSTOCSALIAS |
159 | 1 | 0x489b | GLOBALHANDLENORIP |
11 | 1 | 0xa342 | LOCALHANDLE |
520 | 1 | 0x316c | WOWSETEXITONLASTAPP |
417 | 2 | 0x3b26 | WRITEPROFILESECTION |
94 | 3 | 0x2af | DEFINEHANDLETABLE |
46 | 2 | 0x181c | FREEMODULE |
60 | 3 | 0x6a0 | FINDRESOURCE |
33 | 1 | 0xb59f | LOCKCURRENTTASK |
274 | 1 | 0xb37d | GETSHORTPATHNAME |
328 | 1 | 0xaae7 | _DEBUGOUTPUT |
105 | 3 | 0x66 | GETEXEVERSION |
236 | 2 | 0x3a8a | GETPRODUCTNAME |
module_name | KERNEL |
---|---|
module_description | Microsoft Windows Kernel Interface Version 4.00 |
StringTable 040904E4
CompanyName | Microsoft Corporation |
FileDescription | Windows Kernel |
FileVersion | 3.10 |
InternalName | KERNEL |
LegalCopyright | Copyright © Microsoft Corp. 1981-1996 |
OriginalFilename | KRNL386.EXE |
ProductName | Microsoft® Windows(TM) Operating System |
ProductVersion | 3.10 |
WOW Version | 4.0 |
VS_FIXEDFILEINFO
FileVersion | 3.10.0.103 |
ProductVersion | 3.10.0.103 |
StrucVersion | 0x10000 |
FileFlagsMask | 0x3f |
FileFlags | 0xa |
FileOS | 0x10001 |
FileType | 2 |
FileSubtype | 0 |
Scanning the drive for archives: 1 file, 92448 bytes (91 KiB) Errors: 1
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
everything is OK