cAPSlOCKhASSER.exe - MFC-Anwendung cAPSlOCKhASSER

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	cAPSlOCKhASSER.exe
size	111616 (0x1b400)
md5	7fc090a8f5adf0bcfe2d2cd5563d79ff

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
19	8022	37
10	8447	1
0	0	47
19	8034	19
1	0	464
11	8047	10
14	7299	27
10	8047	137
11	8569	79
11	8966	3
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x3d4a6e6a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x21000
SizeOfInitializedData	0x1b000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3d001
BaseOfCode	0x1000
BaseOfData	0x22000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x41000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.1

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x21000	0x11c00	RW- IDATA
.rdata	0x22000	0x9000	0x2800	RW- IDATA
.data	0x2b000	0x9000	0xc00	RW- IDATA
.rsrc	0x34000	0x9000	0x3000	RW- IDATA
.qtest	0x3d000	0x3000	0x2400	RW- IDATA
.data	0x40000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3dfbc	0x25c
RESOURCE	0x34000	0x8fb8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x3de54	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

show previews

type	name	size
CURSOR	#3	308
CURSOR	#4	180
BITMAP	#130	17624
BITMAP	#26567	1508
BITMAP	#30994	184
BITMAP	#30995	364
BITMAP	#30996	324
ICON	#1	2216
ICON	#2	1384
DIALOG	#100	546
DIALOG	#102	2184
DIALOG	#30721	238
STRING	#7	88
STRING	#3841	170
STRING	#3842	52
STRING	#3843	440
STRING	#3857	1632
STRING	#3858	898
STRING	#3859	910
STRING	#3865	272
STRING	#3866	384
STRING	#3867	1618
STRING	#3868	762
STRING	#3869	42
GROUP_CURSOR	#30977	34
GROUP_ICON	#128	34
VERSION	#1	812

module_name	ord	function_name
kernel32.dll		GetProcAddress
kernel32.dll		GetModuleHandleA
kernel32.dll		LoadLibraryA
user32.dll		GetSysColorBrush
gdi32.dll		SetMapMode
comdlg32.dll		GetFileTitleA
winspool.drv		ClosePrinter
advapi32.dll		RegCloseKey
shell32.dll		Shell_NotifyIconA
comctl32.dll	17
oledlg.dll	8
ole32.dll		CoFreeUnusedLibraries
olepro32.dll	253
oleaut32.dll	185

StringTable 040704B0

CompanyName
FileDescription	MFC-Anwendung cAPSlOCKhASSER
FileVersion	1, 0, 0, 1
InternalName	cAPSlOCKhASSER
LegalCopyright	Copyright (C) 2002
LegalTrademarks
OriginalFilename	cAPSlOCKhASSER.EXE
ProductName	Anwendung cAPSlOCKhASSER
ProductVersion	1, 0, 0, 1

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	111616	EXE	08/02/2002 11:35:06	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x3a6d0

[?] can't find file_offset of VA 0x3a808

[?] can't find file_offset of VA 0x3a8e8

[?] can't find file_offset of VA 0x3afc0

[?] can't find file_offset of VA 0x3b078

[?] can't find file_offset of VA 0x3b1e8

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x3aed0

[?] can't find file_offset of VA 0x3b330

[?] can't find file_offset of VA 0x3b388

[?] can't find file_offset of VA 0x3b438

[?] can't find file_offset of VA 0x3b470

[?] can't find file_offset of VA 0x3b628

[?] can't find file_offset of VA 0x3c128

[?] can't find file_offset of VA 0x3bd98

[?] can't find file_offset of VA 0x3bc88

[?] can't find file_offset of VA 0x3ce08

[?] can't find file_offset of VA 0x3c4b0

[?] can't find file_offset of VA 0x3cb08

[?] can't find file_offset of VA 0x3cf88

[?] can't find file_offset of VA 0x3a8c0

[?] can't find file_offset of VA 0x0

cAPSlOCKhASSER.exe-