2014_1_Alighieri.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	2014_1_Alighieri.exe
size	2355200 (0x23f000)
md5	600da8739ca3848790cbd5c263c49f20

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
199	41118	3
225	20806	39
223	20806	42
203	65501	15
1	0	239
224	21005	355
224	20806	146
222	21005	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x542c20ee
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	12.0
SizeOfCode	0x13e000
SizeOfInitializedData	0x197800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x12c680
BaseOfCode	0x1000
BaseOfData	0x13f000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x2da000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x13ded1	0x13e000	R-X CODE
.rdata	0x13f000	0x1113a	0x11200	R-- IDATA
.data	0x151000	0x17a060	0xe3600	RW- IDATA
.tls	0x2cc000	9	0x200	RW- IDATA
.reloc	0x2cd000	0xc134	0xc200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x14ede4	0xa0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x2cd000	0xc134
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x14ea30	0x18
LOAD_CONFIG	0x14e9e8	0x40
Bound_IAT	0	0
IAT	0x13f000	0x3b0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x6cc000	0x6cc008	0x6c6730	0x53f3dc	0	0x300000

module_name	hint	ord	function_name
WSOCK32.dll		55
WSOCK32.dll		52
WSOCK32.dll		51
WSOCK32.dll		23
WSOCK32.dll		21
WSOCK32.dll		20
WSOCK32.dll		19
WSOCK32.dll		18
WSOCK32.dll		17
WSOCK32.dll		16
WSOCK32.dll		13
WSOCK32.dll		10
WSOCK32.dll		6
WSOCK32.dll		4
WSOCK32.dll		3
WSOCK32.dll		2
WSOCK32.dll		1
WSOCK32.dll		151
WSOCK32.dll		115
WSOCK32.dll		57
USER32.dll	367		GetMessageA
USER32.dll	371		GetMessageW
USER32.dll	831		TranslateMessage
USER32.dll	180		DispatchMessageA
USER32.dll	181		DispatchMessageW
USER32.dll	695		SendMessageA
USER32.dll	160		DefWindowProcA
USER32.dll	161		DefWindowProcW
USER32.dll	625		PostQuitMessage
USER32.dll	647		RegisterClassA
USER32.dll	650		RegisterClassW
USER32.dll	112		CreateWindowExA
USER32.dll	113		CreateWindowExW
USER32.dll	173		DestroyWindow
USER32.dll	800		ShowWindow
USER32.dll	606		OpenClipboard
USER32.dll	75		CloseClipboard
USER32.dll	546		LoadIconA
USER32.dll	168		DestroyCursor
USER32.dll	92		CreateCursor
USER32.dll	542		LoadCursorA
USER32.dll	73		ClientToScreen
USER32.dll	713		SetCursor
USER32.dll	715		SetCursorPos
USER32.dll	2		AdjustWindowRect
USER32.dll	495		InvalidateRect
USER32.dll	233		EndPaint
USER32.dll	14		BeginPaint
USER32.dll	677		ReleaseDC
USER32.dll	308		GetDC
USER32.dll	725		SetForegroundWindow
USER32.dll	855		UpdateWindow
USER32.dll	426		GetSystemMetrics
USER32.dll	339		GetKeyState
USER32.dll	223		EmptyClipboard
USER32.dll	296		GetClipboardData
USER32.dll	710		SetClipboardData
GDI32.dll	49		CreateCompatibleDC
GDI32.dll	414		GdiFlush
GDI32.dll	54		CreateDIBSection
GDI32.dll	725		SelectPalette
GDI32.dll	724		SelectObject
GDI32.dll	657		RealizePalette
GDI32.dll	568		GetStockObject
GDI32.dll	502		GetDeviceCaps
GDI32.dll	74		CreatePalette
GDI32.dll	19		BitBlt
ADVAPI32.dll	648		RegOpenKeyW
ADVAPI32.dll	596		RegCloseKey
ADVAPI32.dll	429		LookupPrivilegeValueW
ADVAPI32.dll	421		LookupAccountNameW
ADVAPI32.dll	423		LookupAccountSidW
ADVAPI32.dll	735		SetSecurityDescriptorDacl
ADVAPI32.dll	723		SetFileSecurityW
ADVAPI32.dll	397		InitializeSecurityDescriptor
ADVAPI32.dll	396		InitializeAcl
ADVAPI32.dll	367		GetTokenInformation
ADVAPI32.dll	351		GetSecurityDescriptorOwner
ADVAPI32.dll	348		GetSecurityDescriptorDacl
ADVAPI32.dll	330		GetLengthSid
ADVAPI32.dll	324		GetFileSecurityW
ADVAPI32.dll	311		GetAclInformation
ADVAPI32.dll	310		GetAce
ADVAPI32.dll	280		EqualSid
ADVAPI32.dll	279		EqualPrefixSid
ADVAPI32.dll	133		CopySid
ADVAPI32.dll	32		AllocateAndInitializeSid
ADVAPI32.dll	31		AdjustTokenPrivileges
ADVAPI32.dll	16		AddAccessAllowedAce
ADVAPI32.dll	530		OpenProcessToken
ADVAPI32.dll	378		GetUserNameW
ADVAPI32.dll	658		RegQueryValueExW
WINMM.dll	171		waveOutGetErrorTextA
WINMM.dll	180		waveOutOpen
WINMM.dll	168		waveOutClose
WINMM.dll	182		waveOutPrepareHeader
WINMM.dll	188		waveOutUnprepareHeader
WINMM.dll	189		waveOutWrite
WINMM.dll	183		waveOutReset
WINMM.dll	155		waveInGetErrorTextA
WINMM.dll	161		waveInOpen
WINMM.dll	152		waveInClose
WINMM.dll	162		waveInPrepareHeader
WINMM.dll	166		waveInUnprepareHeader
WINMM.dll	151		waveInAddBuffer
WINMM.dll	164		waveInStart
WINMM.dll	165		waveInStop
WINMM.dll	163		waveInReset
MPR.dll	63		WNetGetUniversalNameW
KERNEL32.dll	840		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1345		SetUnhandledExceptionFilter
KERNEL32.dll	1408		UnhandledExceptionFilter
KERNEL32.dll	413		FreeEnvironmentStringsW
KERNEL32.dll	551		GetEnvironmentStringsW
KERNEL32.dll	522		GetCurrentProcessId
KERNEL32.dll	1069		QueryPerformanceCounter
KERNEL32.dll	611		GetModuleFileNameW
KERNEL32.dll	610		GetModuleFileNameA
KERNEL32.dll	702		GetStartupInfoW
KERNEL32.dll	882		IsValidCodePage
KERNEL32.dll	1393		TlsAlloc
KERNEL32.dll	674		GetProcessHeap
KERNEL32.dll	526		GetCurrentThreadId
KERNEL32.dll	1483		WideCharToMultiByte
KERNEL32.dll	977		MultiByteToWideChar
KERNEL32.dll	27		AreFileApisANSI
KERNEL32.dll	614		GetModuleHandleExW
KERNEL32.dll	254		DecodePointer
KERNEL32.dll	289		EncodePointer
KERNEL32.dll	726		GetSystemTimeAsFileTime
KERNEL32.dll	871		IsDebuggerPresent
KERNEL32.dll	1395		TlsGetValue
KERNEL32.dll	1087		RaiseException
KERNEL32.dll	1396		TlsSetValue
KERNEL32.dll	1394		TlsFree
KERNEL32.dll	615		GetModuleHandleW
KERNEL32.dll	293		EnterCriticalSection
KERNEL32.dll	930		LeaveCriticalSection
KERNEL32.dll	574		GetFileType
KERNEL32.dll	420		GetACP
KERNEL32.dll	646		GetOEMCP
KERNEL32.dll	435		GetCPInfo
KERNEL32.dll	935		LoadLibraryExW
KERNEL32.dll	1018		OutputDebugStringW
KERNEL32.dll	1260		SetEnvironmentVariableA
KERNEL32.dll	709		GetStringTypeW
KERNEL32.dll	147		CompareStringW
KERNEL32.dll	918		LCMapStringW
KERNEL32.dll	824		HeapSize
KERNEL32.dll	815		HeapAlloc
KERNEL32.dll	476		GetConsoleCP
KERNEL32.dll	1276		SetFilePointerEx
KERNEL32.dll	1312		SetStdHandle
KERNEL32.dll	1502		WriteConsoleW
KERNEL32.dll	215		CreateProcessA
KERNEL32.dll	261		DeleteCriticalSection
KERNEL32.dll	182		CreateEventW
KERNEL32.dll	877		IsProcessorFeaturePresent
KERNEL32.dll	1196		RtlUnwind
KERNEL32.dll	456		GetCommandLineA
KERNEL32.dll	514		GetCurrentDirectoryA
KERNEL32.dll	409		FormatMessageA
KERNEL32.dll	1290		SetLastError
KERNEL32.dll	219		CreateProcessW
KERNEL32.dll	1191		ResumeThread
KERNEL32.dll	556		GetExitCodeProcess
KERNEL32.dll	1375		TerminateProcess
KERNEL32.dll	212		CreatePipe
KERNEL32.dll	287		DuplicateHandle
KERNEL32.dll	809		GlobalUnlock
KERNEL32.dll	802		GlobalLock
KERNEL32.dll	791		GlobalAlloc
KERNEL32.dll	206		CreateMutexA
KERNEL32.dll	1163		ReleaseMutex
KERNEL32.dll	410		FormatMessageW
KERNEL32.dll	803		GlobalMemoryStatus
KERNEL32.dll	704		GetStdHandle
KERNEL32.dll	1103		ReadFile
KERNEL32.dll	1503		WriteFile
KERNEL32.dll	127		CloseHandle
KERNEL32.dll	592		GetLastError
KERNEL32.dll	1263		SetEvent
KERNEL32.dll	1449		WaitForSingleObject
KERNEL32.dll	1363		SleepEx
KERNEL32.dll	562		GetFileAttributesExW
KERNEL32.dll	1360		Sleep
KERNEL32.dll	1077		QueueUserAPC
KERNEL32.dll	337		ExitProcess
KERNEL32.dll	232		CreateThread
KERNEL32.dll	525		GetCurrentThread
KERNEL32.dll	1331		SetThreadPriority
KERNEL32.dll	338		ExitThread
KERNEL32.dll	724		GetSystemTime
KERNEL32.dll	754		GetTickCount
KERNEL32.dll	773		GetVersionExW
KERNEL32.dll	1433		VirtualAlloc
KERNEL32.dll	494		GetConsoleMode
KERNEL32.dll	1234		SetConsoleMode
KERNEL32.dll	186		CreateFileA
KERNEL32.dll	402		FlushFileBuffers
KERNEL32.dll	124		ClearCommBreak
KERNEL32.dll	125		ClearCommError
KERNEL32.dll	1356		SetupComm
KERNEL32.dll	336		EscapeCommFunction
KERNEL32.dll	452		GetCommModemStatus
KERNEL32.dll	454		GetCommState
KERNEL32.dll	1055		PurgeComm
KERNEL32.dll	1206		SetCommBreak
KERNEL32.dll	1209		SetCommState
KERNEL32.dll	1210		SetCommTimeouts
KERNEL32.dll	178		CreateDirectoryW
KERNEL32.dll	194		CreateFileW
KERNEL32.dll	266		DeleteFileW
KERNEL32.dll	360		FindClose
KERNEL32.dll	371		FindFirstFileW
KERNEL32.dll	383		FindNextFileW
KERNEL32.dll	543		GetDriveTypeW
KERNEL32.dll	565		GetFileAttributesW
KERNEL32.dll	567		GetFileInformationByHandle
KERNEL32.dll	585		GetFullPathNameW
KERNEL32.dll	776		GetVolumeInformationW
KERNEL32.dll	1172		RemoveDirectoryW
KERNEL32.dll	1270		SetFileAttributesW
KERNEL32.dll	1275		SetFilePointer
KERNEL32.dll	1279		SetFileTime
KERNEL32.dll	521		GetCurrentProcess
KERNEL32.dll	669		GetProcAddress
KERNEL32.dll	933		LoadLibraryA
KERNEL32.dll	973		MoveFileW

show previews

offset	size	type	comment
0	2355200	EXE	10/01/2014 15:42:38	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x2c6730