Dpicker.exe

info
MZ
PE
resources
strings
imports
exports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	Dpicker.exe
size	3087872 (0x2f1e00)
md5	563902dd19af19065718433640efa47a

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xe
TimeDateStamp	0x5efb6cfa
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x293c00
SizeOfInitializedData	0xb1ea9e
SizeOfUninitializedData	0
AddressOfEntryPoint	0xdc0001
BaseOfCode	0x1000
BaseOfData	0x296000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0xdc4000
SizeOfHeaders	0x600
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.12

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x293000	0xad200	RWX CODE IDATA
.itext	0x294000	0x2000	0xc00	RWX CODE IDATA
.data	0x296000	0xa000	0x4e00	RW- IDATA
.bss	0x2a0000	0x5808	0	RW- IDATA
.idata	0x2a6000	0x4000	0x1200	RW- IDATA
.didata	0x2aa000	0x1000	0x400	RW- IDATA
.edata	0x2ab000	0x1000	0x200	RW- IDATA
.tls	0x2ac000	0x40	0	RW- IDATA
.rdata	0x2ad000	0x1000	0x200	RW- IDATA
.reloc	0x2ae000	0x3a000	0	RW- IDATA DISCARDABLE
.rsrc	0x2e8000	0xa000	0x2a00	RW- IDATA
.debug	0x2f2000	0xace000	0x237e00	RW- IDATA
.aspack	0xdc0000	0x3000	0x2a00	RWX CODE IDATA
.adata	0xdc3000	0x1000	0	RWX IDATA

Data Directory

type	va	size
EXPORT	0x2ab000	0x5e
IMPORT	0xdc1008	0x3c0
RESOURCE	0x2e8000	0x9400
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xdc0fb0	8
DEBUG	0x2f2000	1
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xdc0f98	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

TLS

raw start	raw end	index	callbks	zero fill	flags
0x6ac000	0x6ac040	0x696c10	0x6ad010	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
ICON	#1	4264
STRING	#4069	92
STRING	#4070	1496
STRING	#4071	980
STRING	#4072	1184
STRING	#4073	1176
STRING	#4074	1180
STRING	#4075	684
STRING	#4076	1104
STRING	#4077	160
STRING	#4078	228
STRING	#4079	828
STRING	#4080	1048
STRING	#4081	848
STRING	#4082	1220
STRING	#4083	636
STRING	#4084	1052
STRING	#4085	1200
STRING	#4086	1212
STRING	#4087	916
STRING	#4088	928
STRING	#4089	1052
STRING	#4090	244
STRING	#4091	196
STRING	#4092	616
STRING	#4093	1076
STRING	#4094	864
STRING	#4095	748
STRING	#4096	796
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	1784
RCDATA	PLATFORMTARGETS	2
RCDATA	TFORM1	1717
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	MAINICON	20
VERSION	#1	320
MANIFEST	#1	714

lang

string

65088

02 fb b5 7d ce 81 7e 64  f7 7d b3 39 02 cc 62 c6  |...}..~d.}.9..b.|
19 df a5 f6 9a 6f bc ef  ef 7b 61 1d 50 f1 23 88  |.....o...{a.P.#.|
08 9a 09 65 d9 ff 83 44  13 15 16 1c ec 13 0b e8  |...e...D........|
dd 8e 7f 13 b6 74 c4 4f  07 0b 7f b9 9e f4 3d 30  |.....t.O......=0|
b1 fa 8f 49 12 1e ff f9  61 a0 37 48 52 11 9b e5  |...I....a.7HR...|
aa 67 8e b9 59 2f 5f 51  79 0e e7 df              |.g..Y/_Qy...    |

65104

6c 84 c9 c7 0d 6e 1d 9d  ca 3a bb fe 8b b4 fc e6  |l....n...:......|
7d 7e cb cc 3b 3e b5 6c  8c ae 80 cf 8f fc f7 48  |}~..;>.l.......H|
8b b0 b2 43 06 8b 00 01  b2 1f 59 c9 14 21 0a dd  |...C......Y..!..|
6b f5 3e 7f b7 34 8e 9d  e3 e4 ca 61 bf 51 fc 67  |k.>..4.....a.Q.g|
dc 77 d6 d9 47 0a 1e 4a  77 f5 d1 db 16 34 7e e4  |.w..G..Jw....4~.|
7e 59 b5 ff d7 7d b5 f6  e6 61 d8 c9 ab 57 fe 0c  |~Y...}...a...W..|
12 ca 3e 21 e6 48 a3 bb  cf 25 99 0b 14 a5 77 ff  |..>!.H...%....w.|
25 da 74 79 01 e3 2a ac  4b 8e 64 1f 5d 43 bf 02  |%.ty..*.K.d.]C..|
08 c7 ba 4a 0a 9c 0e a3  f1 49 11 73 f5 e3 c7 c5  |...J.....I.s....|
cb 1d 63 71 12 59 d4 fc  ab ff a1 4c 3e 6a 38 78  |..cq.Y.....L>j8x|
fa 52 f5 7f e0 66 09 b3  3a 13 24 50 b1 7f e7 76  |.R...f..:.$P...v|
7d 4a 92 16 e1 85 7a b6  3b 74 a4 a2 f3 f6 10 f8  |}J....z.;t......|
71 f9 c6 4f 71 b1 4f 60  d2 39 b2 13 ec 92 34 26  |q..Oq.O`.9....4&|
8a b4 28 b8 ea 45 20 11  92 c7 bd bf f5 bf f2 a1  |..(..E .........|
0f 11 9b 93 e2 ee ef da  1f 92 97 ef ef d3 67 0d  |..............g.|
22 d0 44 9b 89 66 b1 44  46 cd 07 19 67 20 a7 35  |".D..f.DF...g .5|
70 62 d0 f1 eb b0 76 12  4c 58 86 f2 93 f3 ff 59  |pb....v.LX.....Y|
4d 0e ef c5 e5 fc 42 3f  3c 53 a4 df a4 1e 63 22  |M.....B?

module_name	hint	ord	function_name
kernel32.dll			GetProcAddress
kernel32.dll			GetModuleHandleA
kernel32.dll			LoadLibraryA
oleaut32.dll			SysFreeString
advapi32.dll			RegQueryValueExW
user32.dll			MessageBoxA
user32.dll			SetClassLongW
gdi32.dll			UnrealizeObject
version.dll			VerQueryValueW
advapi32.dll			RegUnLoadKeyW
oleaut32.dll			SafeArrayPtrOfIndex
oleaut32.dll			GetErrorInfo
ole32.dll			OleUninitialize
comctl32.dll			InitializeFlatSB
user32.dll			EnumDisplayMonitors
msvcrt.dll			memset
shell32.dll			Shell_NotifyIconW
winspool.drv			OpenPrinterW
winspool.drv			GetDefaultPrinterW

ord	entry_va	function_name
1	0x65190	TMethodImplementationIntercept

module_name	Project1.exe
flags	0
timestamp	0
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x2ab02c
Functions(1)	0x2ab028
NameOrdinals(1)	0x2ab030

StringTable 040904E4

FileVersion	1.0.0.0
ProductVersion	1.0.0.0

VS_FIXEDFILEINFO

FileVersion	1.0.0.0
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	3087872	EXE	06/30/2020 16:48:58	#
15c1	15	HTM		#

Scanning the drive for archives:
1 file, 3087872 bytes (3016 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x2eadb4

[?] can't find file_offset of VA 0x2eb254

[?] can't find file_offset of VA 0x2eb6ec

[?] can't find file_offset of VA 0x2ebb88

[?] can't find file_offset of VA 0x2ebe34

[?] can't find file_offset of VA 0x2ec284

[?] can't find file_offset of VA 0x2ec324

[?] can't find file_offset of VA 0x2ec408

[?] can't find file_offset of VA 0x2ec744

[?] can't find file_offset of VA 0x2ecb5c

[?] can't find file_offset of VA 0x2eceac

[?] can't find file_offset of VA 0x2ed370

[?] can't find file_offset of VA 0x2ed5ec

[?] can't find file_offset of VA 0x2eda08

[?] can't find file_offset of VA 0x2edeb8

[?] can't find file_offset of VA 0x2ee374

[?] can't find file_offset of VA 0x2ee708

[?] can't find file_offset of VA 0x2eeaa8

[?] can't find file_offset of VA 0x2eeec4

[?] can't find file_offset of VA 0x2eefb8

[?] can't find file_offset of VA 0x2ef07c

[?] can't find file_offset of VA 0x2ef2e4

[?] can't find file_offset of VA 0x2ef718

[?] can't find file_offset of VA 0x2efa78

[?] can't find file_offset of VA 0x2efd64

[!] string size(128516) > stringtable size(92). truncated to 90

[!] cannot convert "\xB5}\xCE\x81~d\xF7}\xB39\x02\xCCb\xC6\x19\xDF"... to UTF-16

[!] string size(67800) > stringtable size(1496). truncated to 1494

[!] cannot convert "\xC9\xC7\rn\x1D\x9D\xCA:\xBB\xFE\x8B\xB4\xFC\xE6}~"... to UTF-16

[?] can't find file_offset of VA 0x2f0080

[?] can't find file_offset of VA 0x2f0090

[?] can't find file_offset of VA 0x2f0788

[?] can't find file_offset of VA 0x2f078c

[?] can't find file_offset of VA 0x2f0e44

[?] can't find file_offset of VA 0x2f0e58

[?] can't find file_offset of VA 0x2f0e6c

[?] can't find file_offset of VA 0x2f0e80

[?] can't find file_offset of VA 0x2f0e94

[?] can't find file_offset of VA 0x2f0ea8

[?] can't find file_offset of VA 0x2f0ebc

[?] can't find file_offset of VA 0x0