u1210.exe_0_1904640.exe

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	u1210.exe_0_1904640.exe
size	1904640 (0x1d1000)
md5	43a6cbfa78a968259c5638f9aa9a128e

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
95	2190	2
12	7291	4
14	7299	8
10	8168	350
1	0	599
93	2179	31
11	8168	48
6	1720	1
4	8168	7

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x50e14590
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x95000
SizeOfInitializedData	0x4e1000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x7cd000
BaseOfCode	0x1000
BaseOfData	0x96000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x7ce000
SizeOfHeaders	0x1000
CheckSum	0x1da8a0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
	0x1000	0x568000	0xb9000	RWX IDATA
.rsrc	0x569000	0xd260	0x5000	RW- IDATA
.idata	0x577000	0x1000	0x1000	RW- IDATA
	0x578000	0x146000	0x1000	RWX IDATA
ehnusyrx	0x6be000	0x10f000	0x10f000	RWX IDATA
ovdevlrv	0x7cd000	0x1000	0x1000	RWX IDATA

Data Directory

type	va	size
EXPORT	0x7c5854	0x7f
IMPORT	0x57706d	0x95
RESOURCE	0x569000	0xd260
EXCEPTION	0	0
SECURITY	0x1d1000	0x1668
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
CSGD	#194	2115
ICON	#1	3240
ICON	#2	296
ICON	#3	296
ICON	#4	2216
ICON	#5	2216
ICON	#6	744
ICON	#7	744
ICON	#8	2216
ICON	#9	3240
ICON	#10	744
ICON	#11	744
ICON	#12	744
ICON	#13	744
ICON	#14	2216
ICON	#15	2216
ICON	#16	1384
ICON	#17	2216
ICON	#18	1384
ICON	#19	2216
MENU	#129	68
MENU	#129	102
MENU	#129	68
MENU	#135	68
MENU	#135	106
MENU	#135	68
MENU	#136	54
MENU	#136	82
MENU	#136	54
DIALOG	#132	166
DIALOG	#132	186
DIALOG	#132	166
DIALOG	#134	252
DIALOG	#134	368
DIALOG	#134	252
DIALOG	#139	1416
DIALOG	#139	1828
DIALOG	#139	1720
DIALOG	#140	542
DIALOG	#140	706
DIALOG	#140	550
DIALOG	#141	898
DIALOG	#141	1434
DIALOG	#141	918
DIALOG	#142	256
DIALOG	#142	276
DIALOG	#142	252
DIALOG	#165	302
DIALOG	#165	580
DIALOG	#165	302
DIALOG	#178	124
DIALOG	#179	804
DIALOG	#219	176
DIALOG	#219	320
DIALOG	#219	172
STRING	#1	400
STRING	#1	134
STRING	#1	192
STRING	#2	778
STRING	#2	438
STRING	#2	538
GROUP_ICON	#128	20
GROUP_ICON	#148	20
GROUP_ICON	#149	20
GROUP_ICON	#156	20
GROUP_ICON	#158	20
GROUP_ICON	#159	34
GROUP_ICON	#162	20
GROUP_ICON	#163	34
GROUP_ICON	#164	34
GROUP_ICON	#184	20
GROUP_ICON	#187	20
GROUP_ICON	#189	20
GROUP_ICON	#190	20
GROUP_ICON	#191	20
GROUP_ICON	#196	20
GROUP_ICON	#198	20

module_name	hint	ord	function_name
kernel32.dll			lstrcpy
comctl32.dll			InitCommonControls

ord	entry_va	function_name
1	0xde30	_EXECryptor_GetHardwareID@0
2	0xde10	_EXECryptor_IsAppProtected@0

module_name	ultra.exe
flags	0
timestamp	2012-12-31 07:58:08
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x7c5884
Functions(2)	0x7c587c
NameOrdinals(2)	0x7c588c

show previews

offset	size	type	comment
0	1904640	EXE	12/31/2012 07:58:08	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x575058

[?] can't find file_offset of VA 0x574f28

[?] can't find file_offset of VA 0x574f90

[?] can't find file_offset of VA 0x575000

[?] can't find file_offset of VA 0x574e68

[?] can't find file_offset of VA 0x573848

[?] can't find file_offset of VA 0x5739b8

[?] can't find file_offset of VA 0x5740e0

[?] can't find file_offset of VA 0x5743a8

[?] can't find file_offset of VA 0x574948

[?] can't find file_offset of VA 0x574ba0

[?] can't find file_offset of VA 0x574de8

[?] can't find file_offset of VA 0x574a60

[?] can't find file_offset of VA 0x575dc0

[?] can't find file_offset of VA 0x575b80

[?] can't find file_offset of VA 0x5758a0

[?] can't find file_offset of VA 0x575f50

[?] can't find file_offset of VA 0x575c08

[?] can't find file_offset of VA 0x575960