WinHlp32.sfx.exe

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	WinHlp32.sfx.exe
size	8305661 (0x7ebbfd)
md5	78b1ae2c3e5d3f4af6239e6767d7825b

type	PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x454b
blocks_in_file	0x4e52
num_relocs	0x4c45
header_paragraphs	0x3233
min_extra_paragraphs	0x442e
max_extra_paragraphs	0x4c4c
ss	0
sp	0x6f4c
checksum	0x6461
ip	0x694c
cs	0x7262
reloc_table_offset	0x7261
overlay_number	0x4179
reserved0	0x5074654700000000
oem_id	0x6f72
oem_info	0x4163
reserved2	0x65726464
reserved3	0x7373
reserved4	0x63617055
reserved5	0x4479426b
reserved6	0x676e6977
lfanew	0x40

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	2
TimeDateStamp	0x1000
PointerToSymbolTable	8
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	0.57
SizeOfCode	0xe00
SizeOfInitializedData	0x32600
SizeOfUninitializedData	0
AddressOfEntryPoint	0x49d21
BaseOfCode	0x1000
BaseOfData	0x2000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x52000
SizeOfHeaders	0x200
CheckSum	0
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

WinUpack v0.39 final (relocated image base) (By Dwing (c)2005 (h2))

Sections

name	va	vsize	raw size	flags
.Upack	0x1000	0x37000	0	RWX CODE IDATA
.rsrc	0x38000	0x1a000	0x11ffd	RWX CODE IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x49fd5	0x14
RESOURCE	0x38000	0x4b6
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x48	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
VERSION	#1	700	1252
MANIFEST	#1	346	1252

module_name	hint	ord	function_name

VS_FIXEDFILEINFO

dwSignature	0xfeef
FileVersion	0.1.0.0
ProductVersion	0.1.63.0
StrucVersion	1
FileFlagsMask	0
FileFlags	0x40000
FileOS	0x10000
FileType	0
FileSubtype	0

show previews

offset	size	type	comment
0	74237	EXE	01/01/1970 01:08:16	#
15c1	15	HTM		#
121fd	8231424	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 8305661 bytes (8111 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] invalid DOS stub size -205552

[?] invalid VS_VERSIONINFO child type "a\x00r\x00F\x00"

[?] can't find file_offset of VA 0x2

[?] invalid DOS stub size -205552

[?] can't find file_offset of VA 0x48