UltraLightFtpClientWinCE.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	UltraLightFtpClientWinCE.exe
size	30720 (0x7800)
md5	5107fb0527c944a3ba0b5b5231f6a8dd

type	PE32 executable (Windows CE) ARM Thumb, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
131	20720	5
0	0	2
96	4345	2
95	4345	4
93	4017	5
1	0	68
132	20720	8
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x1c2
NumberOfSections	4
TimeDateStamp	0x4d891e6c
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x5200
SizeOfInitializedData	0x2400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4108
BaseOfCode	0x1000
BaseOfData	0x7000
ImageBase	0x10000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0xb000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	9
DllCharacteristics	0
SizeOfStackReserve	0x10000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x517c	0x5200	R-X CODE
.rdata	0x7000	0x1a9a	0x1c00	R-- IDATA
.data	0x9000	0x231	0x200	RW- IDATA
.pdata	0xa000	0x310	0x400	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x8808	0x3c
RESOURCE	0	0
EXCEPTION	0xa000	0x310
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x7000	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x9000	0x118
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
WININET.dll	104		InternetOpenW
WININET.dll	35		FtpGetFileW
WININET.dll	27		FtpDeleteFileW
WININET.dll	40		FtpPutFileW
WININET.dll	42		FtpRemoveDirectoryW
WININET.dll	44		FtpRenameFileW
WININET.dll	25		FtpCreateDirectoryW
WININET.dll	46		FtpSetCurrentDirectoryW
WININET.dll	29		FtpFindFirstFileW
WININET.dll	86		InternetFindNextFileW
WININET.dll	79		InternetConnectW
WININET.dll	74		InternetCloseHandle
WININET.dll	31		FtpGetCurrentDirectoryW
WININET.dll	96		InternetGetLastResponseInfoW
COREDLL.dll		2008
COREDLL.dll		15
COREDLL.dll		16
COREDLL.dll		520
COREDLL.dll		1556
COREDLL.dll		1065
COREDLL.dll		543
COREDLL.dll		1046
COREDLL.dll		1047
COREDLL.dll		1875
COREDLL.dll		1876
COREDLL.dll		87
COREDLL.dll		537
COREDLL.dll		1645
COREDLL.dll		1044
COREDLL.dll		59
COREDLL.dll		69
COREDLL.dll		1134
COREDLL.dll		1138
COREDLL.dll		1094
COREDLL.dll		1456
COREDLL.dll		61
COREDLL.dll		63
COREDLL.dll		36
COREDLL.dll		1097
COREDLL.dll		234
COREDLL.dll		516
COREDLL.dll		58
COREDLL.dll		1571
COREDLL.dll		1575
COREDLL.dll		1574
COREDLL.dll		78
COREDLL.dll		1102
COREDLL.dll		1068
COREDLL.dll		1095
COREDLL.dll		1492
COREDLL.dll		1551
COREDLL.dll		1580
COREDLL.dll		1572
COREDLL.dll		1570
COREDLL.dll		180
COREDLL.dll		517
COREDLL.dll		181
COREDLL.dll		56
COREDLL.dll		167
COREDLL.dll		60
COREDLL.dll		2012
COREDLL.dll		2027
COREDLL.dll		2037
COREDLL.dll		160
COREDLL.dll		169
COREDLL.dll		166
COREDLL.dll		193
COREDLL.dll		33

show previews

offset	size	type	comment
0	30720	EXE	03/22/2011 22:10:52	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK