k-embank_Post.exe

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	k-embank_Post.exe
size	9953280 (0x97e000)
md5	4a81d2ec5d5132d4a649c0ebcfec518d

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xc0

Rich Header

lib id	version	times used
14	7299	1
9	8041	61
13	8169	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4f366e8b
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x810000
SizeOfInitializedData	0x1d000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x82e280
BaseOfCode	0x1000
BaseOfData	0x811000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x999000
SizeOfHeaders	0x1000
CheckSum	0x8158b3
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

HASP HL Protection v1.X (Aladdin)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x80f0c8	0x810000	R-X CODE
.data	0x811000	0x1bff8	0x1000	RW- IDATA
.rsrc	0x82d000	0xfd8	0x1000	R-- IDATA
.protect	0x82e000	0x16abc9	0x16b000	RWX CODE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x998b10	0xb9
RESOURCE	0x82d000	0xfd8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x82f000	0x68
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#30001	3240	1200
GROUP_ICON	#1	20	1200
VERSION	#1	556	1200

module_name	hint	function_name
KERNEL32.dll	185	GetACP
KERNEL32.dll	247	GetCurrentProcess
KERNEL32.dll	248	GetCurrentProcessId
KERNEL32.dll	249	GetCurrentThread
KERNEL32.dll	282	GetLastError
KERNEL32.dll	372	GetVersion
KERNEL32.dll	365	GetTickCount
KERNEL32.dll	372	GetVersion
KERNEL32.dll	718	WaitForSingleObject
KERNEL32.dll	550	ReleaseSemaphore
KERNEL32.dll	52	CreateFileA
KERNEL32.dll	92	DeviceIoControl
KERNEL32.dll	27	CloseHandle
KERNEL32.dll	456	LocalAlloc
KERNEL32.dll	460	LocalFree
KERNEL32.dll	102	EnterCriticalSection
KERNEL32.dll	449	LeaveCriticalSection
KERNEL32.dll	426	InitializeCriticalSection
KERNEL32.dll	85	DeleteCriticalSection
KERNEL32.dll	677	TlsSetValue
KERNEL32.dll	676	TlsGetValue
KERNEL32.dll	674	TlsAlloc
KERNEL32.dll	667	SystemTimeToFileTime
KERNEL32.dll	349	GetSystemTime
KERNEL32.dll	138	FileTimeToSystemTime
KERNEL32.dll	536	ReadFile
KERNEL32.dll	274	GetFileSize
KERNEL32.dll	148	FindFirstFileA
KERNEL32.dll	292	GetModuleFileNameA
KERNEL32.dll	294	GetModuleHandleA
KERNEL32.dll	283	GetLocalTime
KERNEL32.dll	157	FindNextFileA
KERNEL32.dll	612	SetErrorMode
KERNEL32.dll	318	GetProcAddress
KERNEL32.dll	247	GetCurrentProcess
KERNEL32.dll	735	WriteFile
KERNEL32.dll	450	LoadLibraryA
KERNEL32.dll	180	FreeLibrary
KERNEL32.dll	144	FindClose
KERNEL32.dll	248	GetCurrentProcessId
KERNEL32.dll	265	GetEnvironmentVariableA
KERNEL32.dll	463	LocalReAlloc
KERNEL32.dll	282	GetLastError
KERNEL32.dll	563	SearchPathA
KERNEL32.dll	662	Sleep
KERNEL32.dll	497	OpenSemaphoreA
KERNEL32.dll	71	CreateSemaphoreA
SETUPAPI.dll	112	SetupDiEnumDeviceInfo
KERNEL32.dll	294	GetModuleHandleA
KERNEL32.dll	318	GetProcAddress
USER32.dll	446	MessageBoxA
MSVBVM60.DLL		__vbaVarTstGt

StringTable 041204B0

CompanyName	BASIS SOFT
ProductName	K-EMBANK
FileVersion	1.00
ProductVersion	1.00
InternalName	k-embank_Post
OriginalFilename	k-embank_Post.exe

VS_FIXEDFILEINFO

FileVersion	1.0.0.0
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	9947696	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK