tor.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	tor.exe
size	2886442 (0x2c0b2a)
md5	83f5d4f29a9ac0430dc19d8a0c7d977f

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0x12
TimeDateStamp	0x50e6c054
PointerToSymbolTable	0x20f600
NumberOfSymbols	0x59d7
SizeOfOptionalHeader	0xe0
Characteristics	0x107
Magic	0x10b
LinkerVersion	2.22
SizeOfCode	0x16e800
SizeOfInitializedData	0x1f8400
SizeOfUninitializedData	0x3a00
AddressOfEntryPoint	0x126c
BaseOfCode	0x1000
BaseOfData	0x170000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x21e000
SizeOfHeaders	0x600
CheckSum	0x2d0528
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x16e6d0	0x16e800	R-X CODE IDATA
.data	0x170000	0x45dc	0x4600	RW- IDATA
.rdata	0x175000	0x659e8	0x65a00	R-- IDATA
/4	0x1db000	0x1cb60	0x1cc00	R-- IDATA
.bss	0x1f8000	0x3978	0	RW- UDATA
.idata	0x1fc000	0x2b38	0x2c00	RW- IDATA
.CRT	0x1ff000	0x18	0x200	RW- IDATA
.tls	0x200000	0x20	0x200	RW- IDATA
/14	0x201000	0x2c0	0x400	R-- IDATA DISCARDABLE
/29	0x202000	0x6d8	0x800	R-- IDATA DISCARDABLE
/45	0x203000	0x8f8	0xa00	R-- IDATA DISCARDABLE
/61	0x204000	0x74d1	0x7600	R-- IDATA DISCARDABLE
/73	0x20c000	0x1b37	0x1c00	R-- IDATA DISCARDABLE
/87	0x20e000	0x23a0	0x2400	R-- IDATA DISCARDABLE
/99	0x211000	0x10dc	0x1200	R-- IDATA DISCARDABLE
/112	0x213000	0x1f2	0x200	R-- IDATA DISCARDABLE
/123	0x214000	0x858c	0x8600	R-- IDATA DISCARDABLE
/134	0x21d000	0x498	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1fc000	0x2b38
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x200000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1fc6c4	0x5fc
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x600019	0x60001c	0x5f9f60	0x5ff004	0	0

module_name	hint	function_name
ADVAPI32.DLL	93	CryptAcquireContextA
ADVAPI32.DLL	110	CryptGenRandom
ADVAPI32.DLL	386	RegCloseKey
ADVAPI32.DLL	413	RegOpenKeyExA
ADVAPI32.DLL	423	RegQueryValueExA
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	135	CreateFileA
KERNEL32.dll	136	CreateFileMappingA
KERNEL32.dll	147	CreateIoCompletionPort
KERNEL32.dll	160	CreatePipe
KERNEL32.dll	163	CreateProcessA
KERNEL32.dll	169	CreateSemaphoreA
KERNEL32.dll	207	DeleteCriticalSection
KERNEL32.dll	236	EnterCriticalSection
KERNEL32.dll	279	ExitProcess
KERNEL32.dll	300	FindClose
KERNEL32.dll	304	FindFirstFileA
KERNEL32.dll	321	FindNextFileA
KERNEL32.dll	347	FormatMessageA
KERNEL32.dll	352	FreeLibrary
KERNEL32.dll	451	GetCurrentThreadId
KERNEL32.dll	477	GetExitCodeProcess
KERNEL32.dll	492	GetFileSize
KERNEL32.dll	510	GetLastError
KERNEL32.dll	527	GetModuleFileNameA
KERNEL32.dll	529	GetModuleHandleA
KERNEL32.dll	577	GetProcAddress
KERNEL32.dll	602	GetQueuedCompletionStatus
KERNEL32.dll	619	GetSystemDirectoryA
KERNEL32.dll	623	GetSystemInfo
KERNEL32.dll	629	GetSystemTimeAsFileTime
KERNEL32.dll	670	GetVersion
KERNEL32.dll	671	GetVersionExA
KERNEL32.dll	734	InitializeCriticalSection
KERNEL32.dll	735	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	744	InterlockedExchange
KERNEL32.dll	763	IsDBCSLeadByteEx
KERNEL32.dll	814	LeaveCriticalSection
KERNEL32.dll	817	LoadLibraryA
KERNEL32.dll	829	LocalFree
KERNEL32.dll	844	MapViewOfFile
KERNEL32.dll	860	MultiByteToWideChar
KERNEL32.dll	885	OpenProcess
KERNEL32.dll	896	PeekNamedPipe
KERNEL32.dll	897	PostQueuedCompletionStatus
KERNEL32.dll	947	ReadFile
KERNEL32.dll	978	ReleaseSemaphore
KERNEL32.dll	1088	SetHandleInformation
KERNEL32.dll	1140	SetUnhandledExceptionFilter
KERNEL32.dll	1152	Sleep
KERNEL32.dll	1166	TerminateProcess
KERNEL32.dll	1173	TlsGetValue
KERNEL32.dll	1188	UnmapViewOfFile
KERNEL32.dll	1213	VirtualProtect
KERNEL32.dll	1215	VirtualQuery
KERNEL32.dll	1223	WaitForSingleObject
KERNEL32.dll	1247	WideCharToMultiByte
msvcrt.dll	6	_close
msvcrt.dll	23	_fdopen
msvcrt.dll	32	_fstat
msvcrt.dll	37	_getcwd
msvcrt.dll	55	_mkdir
msvcrt.dll	58	_open
msvcrt.dll	64	_read
msvcrt.dll	65	_rmdir
msvcrt.dll	78	_stat
msvcrt.dll	80	_strdup
msvcrt.dll	97	_unlink
msvcrt.dll	98	_utime
msvcrt.dll	109	_write
msvcrt.dll	55	__getmainargs
msvcrt.dll	65	__mb_cur_max
msvcrt.dll	77	__p__environ
msvcrt.dll	79	__p__fmode
msvcrt.dll	99	__set_app_type
msvcrt.dll	137	_assert
msvcrt.dll	142	_beginthread
msvcrt.dll	147	_cexit
msvcrt.dll	157	_close
msvcrt.dll	178	_endthread
msvcrt.dll	182	_errno
msvcrt.dll	224	_fstati64
msvcrt.dll	228	_fullpath
msvcrt.dll	245	_getpid
msvcrt.dll	266	_iob
msvcrt.dll	268	_isctype
msvcrt.dll	310	_locking
msvcrt.dll	316	_lseek
msvcrt.dll	383	_onexit
msvcrt.dll	384	_open
msvcrt.dll	392	_pctype
msvcrt.dll	403	_read
msvcrt.dll	426	_setmode
msvcrt.dll	429	_snprintf
msvcrt.dll	449	_strdup
msvcrt.dll	451	_stricmp
msvcrt.dll	455	_strnicmp
msvcrt.dll	490	_vsnprintf
msvcrt.dll	583	abort
msvcrt.dll	590	atexit
msvcrt.dll	591	atof
msvcrt.dll	592	atoi
msvcrt.dll	595	calloc
msvcrt.dll	604	exit
msvcrt.dll	605	exp
msvcrt.dll	607	fclose
msvcrt.dll	613	fgets
msvcrt.dll	618	fopen
msvcrt.dll	619	fprintf
msvcrt.dll	620	fputc
msvcrt.dll	621	fputs
msvcrt.dll	625	free
msvcrt.dll	631	ftell
msvcrt.dll	633	fwrite
msvcrt.dll	637	getenv
msvcrt.dll	641	gmtime
msvcrt.dll	652	isspace
msvcrt.dll	671	localeconv
msvcrt.dll	672	localtime
msvcrt.dll	673	log
msvcrt.dll	676	malloc
msvcrt.dll	680	memchr
msvcrt.dll	681	memcmp
msvcrt.dll	683	memmove
msvcrt.dll	685	mktime
msvcrt.dll	688	pow
msvcrt.dll	689	printf
msvcrt.dll	692	puts
msvcrt.dll	695	qsort
msvcrt.dll	697	rand
msvcrt.dll	698	realloc
msvcrt.dll	700	rename
msvcrt.dll	704	setlocale
msvcrt.dll	706	signal
msvcrt.dll	711	srand
msvcrt.dll	712	sscanf
msvcrt.dll	713	strcat
msvcrt.dll	714	strchr
msvcrt.dll	715	strcmp
msvcrt.dll	719	strerror
msvcrt.dll	720	strftime
msvcrt.dll	723	strncmp
msvcrt.dll	724	strncpy
msvcrt.dll	726	strrchr
msvcrt.dll	727	strspn
msvcrt.dll	728	strstr
msvcrt.dll	729	strtod
msvcrt.dll	731	strtol
msvcrt.dll	732	strtoul
msvcrt.dll	739	time
msvcrt.dll	748	vfprintf
msvcrt.dll	761	wcslen
SHELL32.DLL	96	SHGetMalloc
SHELL32.DLL	101	SHGetPathFromIDListA
SHELL32.DLL	105	SHGetSpecialFolderLocation
SHELL32.DLL	106	SHGetSpecialFolderPathA
WS2_32.dll	26	WSACleanup
WS2_32.dll	43	WSAGetLastError
WS2_32.dll	54	WSAIoctl
WS2_32.dll	79	WSASetLastError
WS2_32.dll	84	WSAStartup
WS2_32.dll	132	accept
WS2_32.dll	133	bind
WS2_32.dll	134	closesocket
WS2_32.dll	135	connect
WS2_32.dll	139	gethostbyname
WS2_32.dll	140	gethostname
WS2_32.dll	145	getservbyname
WS2_32.dll	147	getsockname
WS2_32.dll	148	getsockopt
WS2_32.dll	149	htonl
WS2_32.dll	150	htons
WS2_32.dll	155	ioctlsocket
WS2_32.dll	156	listen
WS2_32.dll	157	ntohl
WS2_32.dll	158	ntohs
WS2_32.dll	159	recv
WS2_32.dll	160	recvfrom
WS2_32.dll	161	select
WS2_32.dll	162	send
WS2_32.dll	163	sendto
WS2_32.dll	164	setsockopt
WS2_32.dll	166	socket
libssp-0.dll	7	__stack_chk_fail
libssp-0.dll	8	__stack_chk_guard
LIBEAY32.dll	119	ASN1_STRING_to_UTF8
LIBEAY32.dll	131	ASN1_TIME_print
LIBEAY32.dll	245	BIO_ctrl
LIBEAY32.dll	262	BIO_f_buffer
LIBEAY32.dll	272	BIO_free
LIBEAY32.dll	289	BIO_new
LIBEAY32.dll	300	BIO_new_mem_buf
LIBEAY32.dll	301	BIO_new_socket
LIBEAY32.dll	302	BIO_next
LIBEAY32.dll	305	BIO_number_read
LIBEAY32.dll	306	BIO_number_written
LIBEAY32.dll	321	BIO_s_mem
LIBEAY32.dll	343	BIO_write
LIBEAY32.dll	399	BN_bin2bn
LIBEAY32.dll	400	BN_bn2bin
LIBEAY32.dll	402	BN_bn2hex
LIBEAY32.dll	408	BN_cmp
LIBEAY32.dll	409	BN_copy
LIBEAY32.dll	414	BN_dup
LIBEAY32.dll	416	BN_free
LIBEAY32.dll	428	BN_hex2bn
LIBEAY32.dll	464	BN_new
LIBEAY32.dll	471	BN_num_bits
LIBEAY32.dll	486	BN_set_word
LIBEAY32.dll	489	BN_sub_word
LIBEAY32.dll	492	BN_to_ASN1_INTEGER
LIBEAY32.dll	497	BUF_MEM_free
LIBEAY32.dll	655	CONF_modules_unload
LIBEAY32.dll	684	CRYPTO_cleanup_all_ex_data
LIBEAY32.dll	699	CRYPTO_free
LIBEAY32.dll	745	CRYPTO_num_locks
LIBEAY32.dll	754	CRYPTO_set_dynlock_create_callback
LIBEAY32.dll	755	CRYPTO_set_dynlock_destroy_callback
LIBEAY32.dll	756	CRYPTO_set_dynlock_lock_callback
LIBEAY32.dll	759	CRYPTO_set_id_callback
LIBEAY32.dll	762	CRYPTO_set_locking_callback
LIBEAY32.dll	819	DH_check
LIBEAY32.dll	821	DH_compute_key
LIBEAY32.dll	822	DH_free
LIBEAY32.dll	823	DH_generate_key
LIBEAY32.dll	824	DH_generate_parameters
LIBEAY32.dll	829	DH_new
LIBEAY32.dll	834	DH_size
LIBEAY32.dll	1042	ENGINE_by_id
LIBEAY32.dll	1043	ENGINE_cleanup
LIBEAY32.dll	1047	ENGINE_ctrl_cmd_string
LIBEAY32.dll	1049	ENGINE_free
LIBEAY32.dll	1058	ENGINE_get_cipher_engine
LIBEAY32.dll	1062	ENGINE_get_default_DH
LIBEAY32.dll	1066	ENGINE_get_default_RAND
LIBEAY32.dll	1067	ENGINE_get_default_RSA
LIBEAY32.dll	1070	ENGINE_get_digest_engine
LIBEAY32.dll	1077	ENGINE_get_id
LIBEAY32.dll	1082	ENGINE_get_name
LIBEAY32.dll	1096	ENGINE_load_builtin_engines
LIBEAY32.dll	1122	ENGINE_register_all_complete
LIBEAY32.dll	1142	ENGINE_set_default
LIBEAY32.dll	1185	ERR_free_strings
LIBEAY32.dll	1186	ERR_func_error_string
LIBEAY32.dll	1188	ERR_get_error
LIBEAY32.dll	1195	ERR_lib_error_string
LIBEAY32.dll	1224	ERR_load_crypto_strings
LIBEAY32.dll	1226	ERR_peek_error
LIBEAY32.dll	1237	ERR_reason_error_string
LIBEAY32.dll	1239	ERR_remove_state
LIBEAY32.dll	1257	EVP_CIPHER_CTX_cleanup
LIBEAY32.dll	1313	EVP_EncodeFinal
LIBEAY32.dll	1314	EVP_EncodeInit
LIBEAY32.dll	1315	EVP_EncodeUpdate
LIBEAY32.dll	1318	EVP_EncryptInit
LIBEAY32.dll	1320	EVP_EncryptUpdate
LIBEAY32.dll	1384	EVP_PKEY_assign
LIBEAY32.dll	1386	EVP_PKEY_bits
LIBEAY32.dll	1400	EVP_PKEY_free
LIBEAY32.dll	1406	EVP_PKEY_get1_RSA
LIBEAY32.dll	1436	EVP_PKEY_new
LIBEAY32.dll	1453	EVP_PKEY_type
LIBEAY32.dll	1470	EVP_aes_128_ctr
LIBEAY32.dll	1521	EVP_cleanup
LIBEAY32.dll	1570	EVP_sha1
LIBEAY32.dll	1572	EVP_sha256
LIBEAY32.dll	1597	HMAC
LIBEAY32.dll	1720	OBJ_obj2nid
LIBEAY32.dll	1724	OBJ_txt2nid
LIBEAY32.dll	1858	OPENSSL_add_all_algorithms_noconf
LIBEAY32.dll	1860	OPENSSL_cleanse
LIBEAY32.dll	1951	PEM_read_bio_RSAPrivateKey
LIBEAY32.dll	1952	PEM_read_bio_RSAPublicKey
LIBEAY32.dll	2006	PEM_write_bio_RSAPrivateKey
LIBEAY32.dll	2007	PEM_write_bio_RSAPublicKey
LIBEAY32.dll	2195	RAND_bytes
LIBEAY32.dll	2203	RAND_poll
LIBEAY32.dll	2207	RAND_seed
LIBEAY32.dll	2227	RSAPrivateKey_dup
LIBEAY32.dll	2229	RSAPublicKey_dup
LIBEAY32.dll	2238	RSA_check_key
LIBEAY32.dll	2240	RSA_free
LIBEAY32.dll	2242	RSA_generate_key_ex
LIBEAY32.dll	2248	RSA_new
LIBEAY32.dll	2267	RSA_private_decrypt
LIBEAY32.dll	2268	RSA_private_encrypt
LIBEAY32.dll	2269	RSA_public_decrypt
LIBEAY32.dll	2270	RSA_public_encrypt
LIBEAY32.dll	2277	RSA_size
LIBEAY32.dll	2291	SHA1
LIBEAY32.dll	2292	SHA1_Final
LIBEAY32.dll	2293	SHA1_Init
LIBEAY32.dll	2295	SHA1_Update
LIBEAY32.dll	2300	SHA256
LIBEAY32.dll	2301	SHA256_Final
LIBEAY32.dll	2302	SHA256_Init
LIBEAY32.dll	2304	SHA256_Update
LIBEAY32.dll	2342	SSLeay
LIBEAY32.dll	2343	SSLeay_version
LIBEAY32.dll	2703	X509_NAME_ENTRY_get_data
LIBEAY32.dll	2704	X509_NAME_ENTRY_get_object
LIBEAY32.dll	2710	X509_NAME_add_entry_by_NID
LIBEAY32.dll	2713	X509_NAME_cmp
LIBEAY32.dll	2717	X509_NAME_entry_count
LIBEAY32.dll	2718	X509_NAME_free
LIBEAY32.dll	2719	X509_NAME_get_entry
LIBEAY32.dll	2727	X509_NAME_new
LIBEAY32.dll	2845	X509_STORE_add_cert
LIBEAY32.dll	2905	X509_cmp
LIBEAY32.dll	2907	X509_cmp_time
LIBEAY32.dll	2910	X509_dup
LIBEAY32.dll	2914	X509_free
LIBEAY32.dll	2932	X509_get_issuer_name
LIBEAY32.dll	2933	X509_get_pubkey
LIBEAY32.dll	2935	X509_get_serialNumber
LIBEAY32.dll	2936	X509_get_subject_name
LIBEAY32.dll	2949	X509_new
LIBEAY32.dll	2969	X509_set_issuer_name
LIBEAY32.dll	2972	X509_set_pubkey
LIBEAY32.dll	2974	X509_set_subject_name
LIBEAY32.dll	2975	X509_set_version
LIBEAY32.dll	2976	X509_sign
LIBEAY32.dll	2984	X509_time_adj
LIBEAY32.dll	2988	X509_verify
LIBEAY32.dll	3125	d2i_DHparams
LIBEAY32.dll	3232	d2i_RSAPublicKey
LIBEAY32.dll	3257	d2i_X509
LIBEAY32.dll	3338	i2d_DHparams
LIBEAY32.dll	3447	i2d_PublicKey
LIBEAY32.dll	3451	i2d_RSAPublicKey
LIBEAY32.dll	3476	i2d_X509
LIBEAY32.dll	3548	sk_dup
LIBEAY32.dll	3551	sk_free
LIBEAY32.dll	3555	sk_new_null
LIBEAY32.dll	3556	sk_num
LIBEAY32.dll	3559	sk_push
LIBEAY32.dll	3565	sk_value
SSLEAY32.dll	20	SSL_CIPHER_get_name
SSLEAY32.dll	30	SSL_CTX_check_private_key
SSLEAY32.dll	31	SSL_CTX_ctrl
SSLEAY32.dll	33	SSL_CTX_free
SSLEAY32.dll	34	SSL_CTX_get_cert_store
SSLEAY32.dll	46	SSL_CTX_new
SSLEAY32.dll	92	SSL_CTX_set_verify
SSLEAY32.dll	94	SSL_CTX_use_PrivateKey
SSLEAY32.dll	100	SSL_CTX_use_certificate
SSLEAY32.dll	122	SSL_accept
SSLEAY32.dll	134	SSL_connect
SSLEAY32.dll	136	SSL_ctrl
SSLEAY32.dll	137	SSL_do_handshake
SSLEAY32.dll	141	SSL_free
SSLEAY32.dll	153	SSL_get_error
SSLEAY32.dll	154	SSL_get_ex_data
SSLEAY32.dll	156	SSL_get_ex_new_index
SSLEAY32.dll	160	SSL_get_peer_cert_chain
SSLEAY32.dll	161	SSL_get_peer_certificate
SSLEAY32.dll	167	SSL_get_rbio
SSLEAY32.dll	173	SSL_get_session
SSLEAY32.dll	187	SSL_get_wbio
SSLEAY32.dll	190	SSL_library_init
SSLEAY32.dll	192	SSL_load_error_strings
SSLEAY32.dll	193	SSL_new
SSLEAY32.dll	195	SSL_pending
SSLEAY32.dll	196	SSL_read
SSLEAY32.dll	197	SSL_renegotiate
SSLEAY32.dll	206	SSL_set_bio
SSLEAY32.dll	207	SSL_set_cipher_list
SSLEAY32.dll	211	SSL_set_ex_data
SSLEAY32.dll	214	SSL_set_info_callback
SSLEAY32.dll	237	SSL_set_verify
SSLEAY32.dll	241	SSL_shutdown
SSLEAY32.dll	245	SSL_state_string_long
SSLEAY32.dll	258	SSL_write
SSLEAY32.dll	260	SSLv23_method

show previews

offset	size	type	comment
0	2160128	EXE	01/04/2013 11:43:16	#
15c1	15	HTM		#
17b09e	667	HTM		#
20f600	726314	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x1f9f60