filenamefigusia10.exe
size548033 (0x85cc1)
md54a6f27af59ba790b27dffd26e4b0c87c
typePE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0x42
sp0
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x3a6eb141
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10e
Magic0x10b
LinkerVersion4.20
SizeOfCode0xe600
SizeOfInitializedData0x8000
SizeOfUninitializedData0
AddressOfEntryPoint0x28a
BaseOfCode0x1000
BaseOfData0x10000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x1a000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xe5dc0xe600R-X CODE
.rdata0x100000x5a30x600R-- IDATA
.data0x110000x54200x1c00RW- IDATA
.idata0x170000x7800x800RW- IDATA
.rsrc0x180000xa580xc00R-- IDATA
.reloc0x190000xe040x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x170000x64
RESOURCE0x180000xa58
EXCEPTION00
SECURITY00
BASERELOC0x190000x9f0
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x171840x120
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#122160
DIALOG#1011720
GROUP_ICON#201200
module_namehintordfunction_name
KERNEL32.dll243GetLastError
KERNEL32.dll316GetTempPathA
KERNEL32.dll60CreateProcessA
KERNEL32.dll36CopyFileA
KERNEL32.dll251GetModuleFileNameA
KERNEL32.dll613WaitForSingleObject
KERNEL32.dll365HeapFree
KERNEL32.dll475RemoveDirectoryA
KERNEL32.dll532SetFilePointer
KERNEL32.dll398LoadLibraryA
KERNEL32.dll301GetStringTypeW
KERNEL32.dll298GetStringTypeA
KERNEL32.dll141FlushFileBuffers
KERNEL32.dll226GetEnvironmentStringsW
KERNEL32.dll150FreeEnvironmentStringsW
KERNEL32.dll224GetEnvironmentStrings
KERNEL32.dll149FreeEnvironmentStringsA
KERNEL32.dll587UnhandledExceptionFilter
KERNEL32.dll481RtlUnwind
KERNEL32.dll548SetStdHandle
KERNEL32.dll523SetEndOfFile
KERNEL32.dll264GetOEMCP
KERNEL32.dll156GetACP
KERNEL32.dll162GetCPInfo
KERNEL32.dll41CreateDirectoryA
KERNEL32.dll524SetEnvironmentVariableA
KERNEL32.dll208GetCurrentDirectoryA
KERNEL32.dll519SetCurrentDirectoryA
KERNEL32.dll239GetFullPathNameA
KERNEL32.dll222GetDriveTypeA
KERNEL32.dll314GetTempFileNameA
KERNEL32.dll359HeapAlloc
KERNEL32.dll23CloseHandle
KERNEL32.dll238GetFileType
KERNEL32.dll48CreateFileA
KERNEL32.dll466ReadFile
KERNEL32.dll630WriteFile
KERNEL32.dll277GetProcAddress
KERNEL32.dll534SetHandleCount
KERNEL32.dll77DeleteFileA
KERNEL32.dll420MoveFileA
KERNEL32.dll106ExitProcess
KERNEL32.dll577TerminateProcess
KERNEL32.dll210GetCurrentProcess
KERNEL32.dll253GetModuleHandleA
KERNEL32.dll295GetStartupInfoA
KERNEL32.dll169GetCommandLineA
KERNEL32.dll331GetVersion
KERNEL32.dll396LCMapStringW
KERNEL32.dll297GetStdHandle
KERNEL32.dll425MultiByteToWideChar
KERNEL32.dll395LCMapStringA
KERNEL32.dll617WideCharToMultiByte
KERNEL32.dll363HeapDestroy
KERNEL32.dll361HeapCreate
KERNEL32.dll601VirtualFree
KERNEL32.dll598VirtualAlloc
USER32.dll144DispatchMessageA
USER32.dll579TranslateMessage
USER32.dll352IsDialogMessageA
USER32.dll75CreateDialogParamA
USER32.dll497SetDlgItemTextA
USER32.dll138DestroyWindow
USER32.dll405MessageBoxA
USER32.dll243GetDlgItem
USER32.dll473SendMessageA
USER32.dll431PeekMessageA
SHELL32.dll55SHFileOperationA
offsetsizetypecomment
077824EXE01/24/2001 10:41:05#
15c115HTM#
7b41343182JPG#
Scanning the drive for archives:
1 file, 548033 bytes (536 KiB)


--
Type = Cab
WARNINGS:
There are data after the end of archive
Offset = 77844
Physical Size = 426782
Tail Size = 43407
Method = LZX:21
Blocks = 1
Volumes = 1
Volume Index = 0
ID = 15230

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2001-04-08 16:00:00 ....A       465408               jpuzzle.ex_
2001-04-08 16:00:00 ....A        40960               fbmouse.dl_
2001-04-08 16:00:00 ....A         4640               vendor.txt
2001-04-08 16:00:00 ....A        69120               setup.exe
2001-04-08 16:00:00 ....A         4193               license.tx_
2001-04-08 16:00:00 ....A         4292               orderfrm.tx_
2001-04-08 16:00:00 ....A       143802               jpuzzle.hl_
2001-04-08 16:00:00 ....A         2759               jpuzzle.cn_
2001-04-08 16:00:00 ....A        46080               uninstall.ex_
2001-04-08 16:00:00 ....A         4455               readme.txt
2001-04-08 16:00:00 ....A         2463               setup.isc
2001-04-08 16:00:00 ....A       426054               data.pc_
2001-04-08 16:00:00 ....A           54               TiboSoftwareWebSite.ur_
------------------- ----- ------------ ------------  ------------------------
2001-04-08 16:00:00            1214280       548033  13 files

Warnings: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0x28a
[?] can't find EntryPoint RVA (0x28a) file offset
[?] can't find file_offset of VA 0x28a
[?] can't find EntryPoint RVA (0x28a) file offset
[?] can't find file_offset of VA 0x28a
[?] can't find EntryPoint RVA (0x28a) file offset