73.exe - Gallons.exe - Impedimenta

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	73.exe
size	385024 (0x5e000)
md5	757af2bd2331dddae37c92cac738d78f

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
4	8168	219
1	0	73
19	8034	7
0	0	7
11	8168	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4300f6ef
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x12000
SizeOfInitializedData	0x230000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x8680
BaseOfCode	0x1000
BaseOfData	0x13000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x243000
SizeOfHeaders	0x1000
CheckSum	0xdb004933
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x11fc2	0x12000	R-X CODE
.rdata	0x13000	0xa44	0x1000	R-- IDATA
.data	0x14000	0x1e53e0	0x1000	RW- IDATA
.rsrc	0x1fa000	0x487d8	0x49000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x132e8	0x78
RESOURCE	0x1fa000	0x487d8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x13000	0x148
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#27736	957
ICON	#27737	1385
ICON	#27738	4395
ICON	#27739	1034
ICON	#27740	3236
ICON	#27741	2245
ICON	#27742	1341
ICON	#27743	2729
DIALOG	#40375	266
DIALOG	#40376	422
DIALOG	#40377	334
ACCELERATORS	#28713	48
#1000	#33115	27
#1000	#33116	7
#1000	#33117	220179
#1000	#33118	60510
GROUP_ICON	#61693	20
GROUP_ICON	#61694	20
GROUP_ICON	#61695	20
GROUP_ICON	#61696	20
GROUP_ICON	#61697	20
GROUP_ICON	#61698	20
GROUP_ICON	#61699	20
GROUP_ICON	#61700	20
VERSION	#1	496

module_name	hint	function_name
KERNEL32.dll	338	GetStdHandle
KERNEL32.dll	308	GetPrivateProfileIntA
KERNEL32.dll	218	GetConsoleCP
KERNEL32.dll	283	GetLocalTime
KERNEL32.dll	411	HeapCreate
KERNEL32.dll	350	GetSystemTimeAdjustment
KERNEL32.dll	242	GetCurrencyFormatA
KERNEL32.dll	305	GetOEMCP
KERNEL32.dll	48	CreateDirectoryW
KERNEL32.dll	136	FileTimeToDosDateTime
KERNEL32.dll	250	GetCurrentThreadId
KERNEL32.dll	272	GetFileAttributesW
KERNEL32.dll	262	GetEnvironmentStrings
KERNEL32.dll	174	FoldStringW
KERNEL32.dll	247	GetCurrentProcess
KERNEL32.dll	14	BuildCommDCBA
MSVCRT.dll	379	_mbsspnp
GDI32.dll	217	GdiGetBatchLimit
GDI32.dll	289	GetDCOrgEx
GDI32.dll	30	CombineRgn
GDI32.dll	303	GetEnhMetaFilePaletteEntries
GDI32.dll	11	ArcTo
GDI32.dll	153	ExtCreatePen
GDI32.dll	10	Arc
GDI32.dll	441	RestoreDC
GDI32.dll	366	GetTextExtentPoint32A
GDI32.dll	417	PolyPolyline
GDI32.dll	453	SelectClipRgn
GDI32.dll	77	CreateSolidBrush
GDI32.dll	367	GetTextExtentPoint32W
GDI32.dll	355	GetSystemPaletteEntries
GDI32.dll	78	DPtoLP
GDI32.dll	488	SetPixel
GDI32.dll	489	SetPixelFormat
GDI32.dll	48	CreateDIBitmap
GDI32.dll	293	GetDeviceCaps
GDI32.dll	405	PathToRegion
GDI32.dll	469	SetDIBColorTable
GDI32.dll	261	GetBitmapBits
GDI32.dll	360	GetTextCharsetInfo
GDI32.dll	168	FillRgn
GDI32.dll	327	GetMapMode
GDI32.dll	139	EnumFontFamiliesExA
GDI32.dll	395	OffsetRgn
GDI32.dll	43	CreateDCA
GDI32.dll	16	BeginPath
GDI32.dll	359	GetTextCharset
GDI32.dll	482	SetMapMode
GDI32.dll	493	SetRectRgn
GDI32.dll	47	CreateDIBSection
GDI32.dll	59	CreateFontW
GDI32.dll	500	SetTextJustification
GDI32.dll	396	OffsetViewportOrgEx
GDI32.dll	267	GetCharABCWidthsA
GDI32.dll	66	CreatePalette
GDI32.dll	439	ResetDCW
GDI32.dll	462	SetBkMode
GDI32.dll	38	CreateBrushIndirect
GDI32.dll	35	CopyMetaFileW
GDI32.dll	341	GetPath
GDI32.dll	286	GetCurrentObject
GDI32.dll	501	SetViewportExtEx
GDI32.dll	455	SelectObject
GDI32.dll	64	CreateMetaFileA
GDI32.dll	506	SetWindowOrgEx
GDI32.dll	322	GetKerningPairsA
GDI32.dll	291	GetDIBColorTable
GDI32.dll	403	PaintRgn
COMCTL32.dll	34	ImageList_Destroy
COMCTL32.dll	48	ImageList_GetImageCount
COMCTL32.dll	54	ImageList_Merge
COMCTL32.dll	40	ImageList_DrawEx
ADVAPI32.dll	425	SetSecurityInfo
ADVAPI32.dll	170	GetFileSecurityA
ADVAPI32.dll	202	GetSidSubAuthorityCount
ADVAPI32.dll	30	BuildExplicitAccessWithNameA
ADVAPI32.dll	370	RegOpenKeyExA

StringTable 000004b0

CompanyName	ActiveState
FileDescription	Impedimenta
InternalName	Lark
LegalCopyright	Message (C) 2017
OriginalFilename	Gallons.exe

VS_FIXEDFILEINFO

FileVersion	0.237.164.11
ProductVersion	0.228.4.48
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	385024	EXE	08/15/2005 20:11:27	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid VS_VERSIONINFO child type "H\x000\x006\x00"

73.exe-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 000004b0

VS_FIXEDFILEINFO

73.exe
-