addupp.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	addupp.exe
size	46080 (0xb400)
md5	82b4dd47f866c23cfd43874a7415ba3a

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
1	0	74
185	30716	3
207	50413	25
205	50323	10
206	50413	88
206	50522	1
204	50522	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x518c1f9d
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	11.0
SizeOfCode	0x7000
SizeOfInitializedData	0x5e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x124f
BaseOfCode	0x1000
BaseOfData	0x8000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xf000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6ea0	0x7000	R-X CODE
.rdata	0x8000	0x2374	0x2400	R-- IDATA
.data	0xb000	0x2b84	0xe00	RW- IDATA
.reloc	0xe000	0xc8e	0xe00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x9d94	0x28
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xe000	0x738
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x9a38	0x40
Bound_IAT	0	0
IAT	0x8000	0x104
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
KERNEL32.dll	481	GetCommandLineA
KERNEL32.dll	896	IsDebuggerPresent
KERNEL32.dll	315	EncodePointer
KERNEL32.dll	278	DecodePointer
KERNEL32.dll	901	IsProcessorFeaturePresent
KERNEL32.dll	319	EnterCriticalSection
KERNEL32.dll	954	LeaveCriticalSection
KERNEL32.dll	615	GetLastError
KERNEL32.dll	1298	SetLastError
KERNEL32.dll	423	FlsAlloc
KERNEL32.dll	425	FlsGetValue
KERNEL32.dll	426	FlsSetValue
KERNEL32.dll	424	FlsFree
KERNEL32.dll	878	InterlockedIncrement
KERNEL32.dll	874	InterlockedDecrement
KERNEL32.dll	551	GetCurrentThreadId
KERNEL32.dll	438	FreeEnvironmentStringsW
KERNEL32.dll	364	ExitProcess
KERNEL32.dll	637	GetModuleHandleExW
KERNEL32.dll	690	GetProcAddress
KERNEL32.dll	1001	MultiByteToWideChar
KERNEL32.dll	730	GetStdHandle
KERNEL32.dll	1510	WriteFile
KERNEL32.dll	634	GetModuleFileNameW
KERNEL32.dll	695	GetProcessHeap
KERNEL32.dll	598	GetFileType
KERNEL32.dll	867	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	285	DeleteCriticalSection
KERNEL32.dll	862	InitOnceExecuteOnce
KERNEL32.dll	724	GetStartupInfoW
KERNEL32.dll	633	GetModuleFileNameA
KERNEL32.dll	1081	QueryPerformanceCounter
KERNEL32.dll	753	GetSystemTimeAsFileTime
KERNEL32.dll	782	GetTickCount64
KERNEL32.dll	1417	UnhandledExceptionFilter
KERNEL32.dll	1355	SetUnhandledExceptionFilter
KERNEL32.dll	546	GetCurrentProcess
KERNEL32.dll	1385	TerminateProcess
KERNEL32.dll	638	GetModuleHandleW
KERNEL32.dll	846	HeapFree
KERNEL32.dll	1370	Sleep
KERNEL32.dll	906	IsValidCodePage
KERNEL32.dll	445	GetACP
KERNEL32.dll	669	GetOEMCP
KERNEL32.dll	460	GetCPInfo
KERNEL32.dll	1490	WideCharToMultiByte
KERNEL32.dll	1207	RtlUnwind
KERNEL32.dll	959	LoadLibraryExW
KERNEL32.dll	575	GetEnvironmentStringsW
KERNEL32.dll	1042	OutputDebugStringW
KERNEL32.dll	960	LoadLibraryW
KERNEL32.dll	428	FlushFileBuffers
KERNEL32.dll	501	GetConsoleCP
KERNEL32.dll	519	GetConsoleMode
KERNEL32.dll	842	HeapAlloc
KERNEL32.dll	849	HeapReAlloc
KERNEL32.dll	941	LCMapStringEx
KERNEL32.dll	735	GetStringTypeW
KERNEL32.dll	1286	SetFilePointerEx
KERNEL32.dll	851	HeapSize
KERNEL32.dll	141	CloseHandle
KERNEL32.dll	1322	SetStdHandle
KERNEL32.dll	1509	WriteConsoleW
KERNEL32.dll	213	CreateFileW

show previews

offset	size	type	comment
0	46080	EXE	05/09/2013 22:13:49	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK