filename8759j3f434(2)
size270848 (0x42200)
md53c89456ba5ab540e445a632ccfbbb958
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1323072933
1493072921
13130729112
1235072733
10189
138307291
148210221
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x5720cdbb
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x11800
SizeOfInitializedData0x30600
SizeOfUninitializedData0
AddressOfEntryPoint0x6483
BaseOfCode0x1000
BaseOfData0x13000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x48000
SizeOfHeaders0x400
CheckSum0x42ea9
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x117fc0x11800R-X CODE
.rdata0x130000x1f93a0x1fa00R-- IDATA
.data0x330000xd2580xb800RW- IDATA
.tls0x4100090x200RW- IDATA
.rsrc0x420000x33ac0x3400R-- IDATA
.reloc0x460000x1d520x1e00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x318e00x154
RESOURCE0x420000x33ac
EXCEPTION00
SECURITY00
BASERELOC0x460000x10ec
DEBUG0x133300x1c
ARCHITECTURE00
GLOBALPTR00
TLS0x156680x18
LOAD_CONFIG0x156200x40
Bound_IAT00
IAT0x130000x2e8
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4410000x4410080x43f0e80x41331000
typenamesizecp
BITMAP#6001710661252
BITMAP#6001816421252
BITMAP#6001923461252
BITMAP#6002041381252
DIALOG#2126861252
DIALOG#213441252
STRING#13061252
STRING#22641252
STRING#31661252
STRING#42101252
STRING#52641252
STRING#66481252
STRING#73001252
MANIFEST#13461252
idlangstring
11033IME Pad
21033IME Pad Menu
31033Applet Menu
41033Back
51033Version
61033Help
71033IME Pad's Help
81033Close
91033IME Pad Properties
101033Add Applets
111033Left
121033Right
131033Applet's title
141033FileName
151033User Settings
161033Undef
171033Undef
181033Undef
191033 Property
201033 Help
211033< &Back
221033&Next >
231033&Finish
241033Undef
251033Undef
261033Undef
271033Auto
281033English
291033Chinese(PRC)
301033Chinese(Traditional)
311033Japanese
321033Korean
331033BS
341033Enter
351033Space
361033Del
371033Esc
381033Home
391033PgUp
401033Tab
411033Win
421033End
431033PgDn
441033Insert
451033Appkey
461033None
471033Pinyin
481033BPMF/Chgjie
491033Conv
501033Hanja
5110330x00
5210330xC0
5310330x1C/0x1C
5410330x1C
5510330x19
561033BackSpace
571033Enter
581033Space
591033Delete
601033Escape
611033Home
621033PageUp
631033Tab
641033Window
651033End
661033PageDown
671033Insert
681033AppKey
691033ArrowLeft
701033ArrowRight
711033ArrowUp
721033ArrowDown
731033None
741033PinYin
751033Bopomofo/ChangJie
761033Conversion
771033Undef
781033Undef
791033Undef
801033Undef
811033Undef
821033The specified folder does not exist.
831033The specified folder does not exist. Do you want to create it?
841033Failed to create folder.
851033There is no IME Pad Applet in this folder.
861033Not enough memory.
871033Cannot find specified Applet.
881033This operation requires Administrator privileges.
891033Undef
901033Undef
911033Undef
921033Undef
931033Undef
941033Undef
951033Segoe UI
961033Segoe UI
971033Segoe UI
981033Segoe UI
991033Segoe UI
1001033Segoe UI
1011033Segoe UI
1021033Segoe UI
1031033About IME Pad
1041033Microsoft® IME Pad
1051033© Microsoft Corporation. All rights reserved.
1061033OK
module_namehintordfunction_name
KERNEL32.dll837Process32Next
KERNEL32.dll775LockResource
KERNEL32.dll502GetModuleHandleA
KERNEL32.dll172CreateToolhelp32Snapshot
KERNEL32.dll67CloseHandle
KERNEL32.dll321FlushFileBuffers
KERNEL32.dll120CreateFileA
KERNEL32.dll678HeapSize
KERNEL32.dll1164WriteConsoleW
KERNEL32.dll409GetConsoleOutputCP
KERNEL32.dll1154WriteConsoleA
KERNEL32.dll1020SetStdHandle
KERNEL32.dll488GetLocaleInfoA
KERNEL32.dll576GetStringTypeW
KERNEL32.dll573GetStringTypeA
KERNEL32.dll753LoadLibraryA
KERNEL32.dll737LCMapStringA
KERNEL32.dll914RtlUnwind
KERNEL32.dll693InitializeCriticalSectionAndSpinCount
KERNEL32.dll405GetConsoleMode
KERNEL32.dll387GetConsoleCP
KERNEL32.dll991SetFilePointer
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll614GetTickCount
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll471GetFileType
KERNEL32.dll1000SetHandleCount
KERNEL32.dll449GetEnvironmentStringsW
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll331FreeEnvironmentStringsW
KERNEL32.dll447GetEnvironmentStrings
KERNEL32.dll330FreeEnvironmentStringsA
KERNEL32.dll486GetLastError
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll1075TlsFree
KERNEL32.dll1077TlsSetValue
KERNEL32.dll1074TlsAlloc
KERNEL32.dll1004SetLastError
KERNEL32.dll794MultiByteToWideChar
KERNEL32.dll793MulDiv
KERNEL32.dll671HeapCreate
KERNEL32.dll114CreateEventA
KERNEL32.dll1056SizeofResource
KERNEL32.dll1057Sleep
KERNEL32.dll311FindResourceExA
KERNEL32.dll238EnumResourceTypesA
KERNEL32.dll712IsBadReadPtr
KERNEL32.dll821OpenSemaphoreA
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll835Process32First
KERNEL32.dll1097UpdateResourceA
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll669HeapAlloc
KERNEL32.dll758LoadResource
KERNEL32.dll739LCMapStringW
KERNEL32.dll335FreeResource
KERNEL32.dll1076TlsGetValue
KERNEL32.dll731IsValidCodePage
KERNEL32.dll531GetOEMCP
KERNEL32.dll338GetACP
KERNEL32.dll700InterlockedDecrement
KERNEL32.dll704InterlockedIncrement
KERNEL32.dll347GetCPInfo
KERNEL32.dll500GetModuleFileNameA
KERNEL32.dll571GetStdHandle
KERNEL32.dll1165WriteFile
KERNEL32.dll260ExitProcess
KERNEL32.dll544GetProcAddress
KERNEL32.dll505GetModuleHandleW
KERNEL32.dll676HeapReAlloc
KERNEL32.dll1108VirtualAlloc
KERNEL32.dll1111VirtualFree
KERNEL32.dll673HeapFree
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll1069TerminateProcess
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll367GetCommandLineA
USER32.dll472LoadImageA
USER32.dll745UpdateWindow
USER32.dll683SetWindowTextA
USER32.dll367GetSystemMetrics
USER32.dll158DestroyMenu
USER32.dll289GetDlgItemTextA
USER32.dll285GetDialogBaseUnits
USER32.dll517MoveWindow
USER32.dll213EndPaint
USER32.dll330GetMessageA
USER32.dll392GetWindowRect
USER32.dll606SendMessageA
USER32.dll601SendDlgItemMessageA
USER32.dll719TrackPopupMenu
USER32.dll239FillRect
USER32.dll615SetCapture
USER32.dll775wsprintfA
USER32.dll269GetClientRect
USER32.dll100CreateMenu
USER32.dll633SetFocus
USER32.dll397GetWindowTextLengthA
USER32.dll544PostQuitMessage
USER32.dll14BeginPaint
USER32.dll282GetDC
USER32.dll257GetCapture
USER32.dll725TranslateMessage
USER32.dll316GetMenu
USER32.dll396GetWindowTextA
USER32.dll657SetRect
USER32.dll676SetWindowLongA
USER32.dll426InvalidateRect
USER32.dll385GetWindowLongA
USER32.dll103CreateWindowExA
USER32.dll588ReleaseDC
USER32.dll287GetDlgItem
USER32.dll149DefWindowProcA
USER32.dll364GetSysColor
USER32.dll679SetWindowPos
USER32.dll281GetCursorPos
USER32.dll696ShowWindow
USER32.dll639SetMenu
USER32.dll101CreatePopupMenu
USER32.dll442IsDlgButtonChecked
USER32.dll168DispatchMessageA
GDI32.dll516GetTextExtentPoint32A
GDI32.dll205DeleteDC
GDI32.dll51CreateDIBSection
GDI32.dll58CreateFontA
GDI32.dll437GetDeviceCaps
GDI32.dll208DeleteObject
GDI32.dll606SelectObject
GDI32.dll46CreateCompatibleDC
GDI32.dll599SaveDC
GDI32.dll592RestoreDC
GDI32.dll82CreateSolidBrush
GDI32.dll671TextOutA
GDI32.dll18BitBlt
ADVAPI32.dll340GetTokenInformation
ADVAPI32.dll497OpenProcessToken
SHELL32.dll117SHBindToParent
SHELL32.dll239SHParseDisplayName
SHELL32.dll177SHGetDataFromIDListA
ole32.dll103CoTaskMemFree
ODBC32.dll3
ODBC32.dll7
ODBC32.dll1
ODBC32.dll2
ODBC32.dll13
ODBC32.dll45
ODBC32.dll47
WININET.dll158InternetReadFile
WS2_32.dll21
WS2_32.dll54WSAIoctl
MPR.dll5WNetAddConnection2A
MSIMG32.dll3TransparentBlt
RPCRT4.dll341RpcBindingFree
RPCRT4.dll485RpcStringBindingComposeA
RPCRT4.dll356RpcBindingSetAuthInfoA
RPCRT4.dll342RpcBindingFromStringBindingA
RPCRT4.dll489RpcStringFreeA
RPCRT4.dll450RpcServerUseProtseqEpA
Secur32.dll80SetContextAttributesA
XmlLite.dllCreateXmlReader
SETUPAPI.dll317SetupDiDestroyDeviceInfoList
SETUPAPI.dll321SetupDiEnumDeviceInterfaces
SETUPAPI.dll337SetupDiGetClassDevsA
RPCNS4.dll10RpcNsBindingImportBeginA
offsetsizetypecomment
0270848EXE04/27/2016 14:33:31#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x3f0e8