filenamegui.exe
size141312 (0x22800)
md5570a98ee223d0117defc9a6953b27701
typePE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x533457cb
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x30f
Magic0x10b
LinkerVersion2.23
SizeOfCode0x1d400
SizeOfInitializedData0x22400
SizeOfUninitializedData0x16200
AddressOfEntryPoint0x12a0
BaseOfCode0x1000
BaseOfData0x1f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x3f000
SizeOfHeaders0x400
CheckSum0x29515
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x1d2f00x1d400R-X CODE IDATA
.data0x1f0000xc40x200RW- IDATA
.rdata0x200000x2fc00x3000R-- IDATA
.eh_fram0x230000x3f80x400R-- IDATA
.bss0x240000x161b00RW- UDATA
.idata0x3b0000x15200x1600RW- IDATA
.CRT0x3d0000x1c0x200RW- IDATA
.tls0x3e0000x200x200RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x3b0000x1520
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x3e0000x18
LOAD_CONFIG00
Bound_IAT00
IAT0x3b3880x2fc
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x43e0190x43e01c0x43a0dc0x43d00400
module_namehintordfunction_name
GDI32.dll12BitBlt
GDI32.dll17CloseEnhMetaFile
GDI32.dll34CreateCompatibleDC
GDI32.dll36CreateDCW
GDI32.dll39CreateDIBSection
GDI32.dll45CreateEnhMetaFileW
GDI32.dll48CreateFontIndirectW
GDI32.dll49CreateFontW
GDI32.dll51CreateHatchBrush
GDI32.dll58CreatePen
GDI32.dll62CreateRectRgn
GDI32.dll67CreateSolidBrush
GDI32.dll70DeleteDC
GDI32.dll71DeleteEnhMetaFile
GDI32.dll73DeleteObject
GDI32.dll79Ellipse
GDI32.dll80EndDoc
GDI32.dll81EndPage
GDI32.dll103ExtTextOutW
GDI32.dll136GetCharacterPlacementW
GDI32.dll137GetClipBox
GDI32.dll138GetClipRgn
GDI32.dll141GetCurrentObject
GDI32.dll148GetDeviceCaps
GDI32.dll187GetObjectW
GDI32.dll201GetStockObject
GDI32.dll209GetTextColor
GDI32.dll231LineTo
GDI32.dll234MoveToEx
GDI32.dll240PatBlt
GDI32.dll243PlayEnhMetaFile
GDI32.dll263Rectangle
GDI32.dll273RoundRect
GDI32.dll279SelectClipRgn
GDI32.dll281SelectObject
GDI32.dll288SetBkMode
GDI32.dll323SetTextColor
GDI32.dll332StartDocW
GDI32.dll333StartPage
GDI32.dll334StretchBlt
GDI32.dll340TextOutW
KERNEL32.dll3AddAtomA
KERNEL32.dll82CloseHandle
KERNEL32.dll129CreateEventA
KERNEL32.dll142CreateFileW
KERNEL32.dll154CreateMutexA
KERNEL32.dll169CreateSemaphoreA
KERNEL32.dll207DeleteCriticalSection
KERNEL32.dll212DeleteFileW
KERNEL32.dll230DuplicateHandle
KERNEL32.dll236EnterCriticalSection
KERNEL32.dll279ExitProcess
KERNEL32.dll298FindAtomA
KERNEL32.dll300FindClose
KERNEL32.dll311FindFirstFileW
KERNEL32.dll323FindNextFileW
KERNEL32.dll363GetAtomNameA
KERNEL32.dll388GetCommandLineA
KERNEL32.dll445GetCurrentDirectoryW
KERNEL32.dll446GetCurrentProcess
KERNEL32.dll450GetCurrentThread
KERNEL32.dll451GetCurrentThreadId
KERNEL32.dll492GetFileSize
KERNEL32.dll507GetHandleInformation
KERNEL32.dll510GetLastError
KERNEL32.dll529GetModuleHandleA
KERNEL32.dll532GetModuleHandleW
KERNEL32.dll577GetProcAddress
KERNEL32.dll578GetProcessAffinityMask
KERNEL32.dll606GetStartupInfoA
KERNEL32.dll642GetThreadContext
KERNEL32.dll650GetThreadPriority
KERNEL32.dll656GetTickCount
KERNEL32.dll687GlobalAlloc
KERNEL32.dll698GlobalLock
KERNEL32.dll702GlobalSize
KERNEL32.dll705GlobalUnlock
KERNEL32.dll734InitializeCriticalSection
KERNEL32.dll743InterlockedDecrement
KERNEL32.dll745InterlockedExchangeAdd
KERNEL32.dll747InterlockedIncrement
KERNEL32.dll814LeaveCriticalSection
KERNEL32.dll859MulDiv
KERNEL32.dll947ReadFile
KERNEL32.dll974ReleaseMutex
KERNEL32.dll978ReleaseSemaphore
KERNEL32.dll995ResetEvent
KERNEL32.dll999ResumeThread
KERNEL32.dll1065SetEvent
KERNEL32.dll1078SetFilePointer
KERNEL32.dll1091SetLastError
KERNEL32.dll1102SetProcessAffinityMask
KERNEL32.dll1121SetThreadContext
KERNEL32.dll1129SetThreadPriority
KERNEL32.dll1140SetUnhandledExceptionFilter
KERNEL32.dll1152Sleep
KERNEL32.dll1160SuspendThread
KERNEL32.dll1171TlsAlloc
KERNEL32.dll1173TlsGetValue
KERNEL32.dll1174TlsSetValue
KERNEL32.dll1180TryEnterCriticalSection
KERNEL32.dll1213VirtualProtect
KERNEL32.dll1215VirtualQuery
KERNEL32.dll1221WaitForMultipleObjects
KERNEL32.dll1223WaitForSingleObject
KERNEL32.dll1267WriteFile
msvcrt.dll109_write
msvcrt.dll55__getmainargs
msvcrt.dll77__p__environ
msvcrt.dll79__p__fmode
msvcrt.dll99__set_app_type
msvcrt.dll143_beginthreadex
msvcrt.dll147_cexit
msvcrt.dll179_endthreadex
msvcrt.dll225_ftime
msvcrt.dll266_iob
msvcrt.dll383_onexit
msvcrt.dll422_setjmp
msvcrt.dll426_setmode
msvcrt.dll583abort
msvcrt.dll590atexit
msvcrt.dll595calloc
msvcrt.dll604exit
msvcrt.dll619fprintf
msvcrt.dll620fputc
msvcrt.dll621fputs
msvcrt.dll625free
msvcrt.dll633fwrite
msvcrt.dll675longjmp
msvcrt.dll676malloc
msvcrt.dll681memcmp
msvcrt.dll682memcpy
msvcrt.dll683memmove
msvcrt.dll684memset
msvcrt.dll689printf
msvcrt.dll698realloc
msvcrt.dll706signal
msvcrt.dll709sprintf
msvcrt.dll715strcmp
msvcrt.dll721strlen
msvcrt.dll748vfprintf
USER32.dll1AdjustWindowRect
USER32.dll11BeginPaint
USER32.dll38CharLowerW
USER32.dll52CharUpperW
USER32.dll61CloseClipboard
USER32.dll91CreateWindowExW
USER32.dll135DefWindowProcW
USER32.dll144DestroyWindow
USER32.dll150DispatchMessageW
USER32.dll164DrawFocusRect
USER32.dll166DrawFrameControl
USER32.dll175DrawTextW
USER32.dll177EmptyClipboard
USER32.dll184EndPaint
USER32.dll218GetActiveWindow
USER32.dll230GetClassInfoW
USER32.dll236GetClientRect
USER32.dll238GetClipboardData
USER32.dll258GetFocus
USER32.dll268GetKeyState
USER32.dll297GetMessageW
USER32.dll326GetSystemMetrics
USER32.dll343GetWindowLongW
USER32.dll353GetWindowTextW
USER32.dll370InvalidateRect
USER32.dll376IsCharAlphaW
USER32.dll382IsClipboardFormatAvailable
USER32.dll397IsWindowVisible
USER32.dll408LoadCursorW
USER32.dll412LoadImageW
USER32.dll439MessageBoxW
USER32.dll455OpenClipboard
USER32.dll465PeekMessageW
USER32.dll467PostMessageW
USER32.dll468PostQuitMessage
USER32.dll482RegisterClassW
USER32.dll523SetClipboardData
USER32.dll525SetCursor
USER32.dll533SetFocus
USER32.dll570SetWindowLongW
USER32.dll575SetWindowTextW
USER32.dll585ShowWindow
USER32.dll608TranslateMessage
WINSPOOL.DRV86GetDefaultPrinterW
offsetsizetypecomment
0141312EXE03/27/2014 16:54:35#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x3a0dc