1111.exe - 小白一键重装系统 - 小白一键重装系统

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	1111.exe
size	5396992 (0x525a00)
md5	8a9e4d778621f7c4f887299013cad36d

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xa
TimeDateStamp	0x2a425e19
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0xd4c00
SizeOfInitializedData	0xb95200
SizeOfUninitializedData	0
AddressOfEntryPoint	0xc73001
BaseOfCode	0x1000
BaseOfData	0xd6000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xc7c000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.12

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
CODE	0x1000	0xd5000	0x53600	RW- IDATA
DATA	0xd6000	0x5000	0x2000	RW- IDATA
BSS	0xdb000	0x4000	0	RW- IDATA
.idata	0xdf000	0x3000	0x1000	RW- IDATA
.tls	0xe2000	0x1000	0	RW- IDATA
.rdata	0xe3000	0x1000	0x200	RW- IDATA
.reloc	0xe4000	0xf000	0	RW- IDATA
.rsrc	0xf3000	0xb80000	0x4c6e00	RW- IDATA
.data	0xc73000	0x8000	0x8000	RW- IDATA
.adata	0xc7b000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xc73fac	0x3e4
RESOURCE	0xf3000	0xb7f200
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xc73f54	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xc73f3c	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

TLS

raw start	raw end	index	callbks	zero fill	flags
0x4e2000	0x4e2010	0x4d609c	0x4e3010	0	0

show previews

type	name	size
XBGHOSTFILE	XBGHOST_RES_USER1	269885
XBGHOSTFILE	XBGHOST_RES_USER10	264648
XBGHOSTFILE	XBGHOST_RES_USER11	19968
XBGHOSTFILE	XBGHOST_RES_USER12	503808
XBGHOSTFILE	XBGHOST_RES_USER13	348160
XBGHOSTFILE	XBGHOST_RES_USER14	100808
XBGHOSTFILE	XBGHOST_RES_USER15	248264
XBGHOSTFILE	XBGHOST_RES_USER16	59904
XBGHOSTFILE	XBGHOST_RES_USER17	24072
XBGHOSTFILE	XBGHOST_RES_USER18	55808
XBGHOSTFILE	XBGHOST_RES_USER2	9216
XBGHOSTFILE	XBGHOST_RES_USER3	4423680
XBGHOSTFILE	XBGHOST_RES_USER4	302144
XBGHOSTFILE	XBGHOST_RES_USER5	248264
XBGHOSTFILE	XBGHOST_RES_USER6	89600
XBGHOSTFILE	XBGHOST_RES_USER7	92080
XBGHOSTFILE	XBGHOST_RES_USER8	3492296
XBGHOSTFILE	XBGHOST_RES_USER9	40
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
BITMAP	BBABORT	464
BITMAP	BBALL	484
BITMAP	BBCANCEL	464
BITMAP	BBCLOSE	464
BITMAP	BBHELP	464
BITMAP	BBIGNORE	464
BITMAP	BBNO	464
BITMAP	BBOK	464
BITMAP	BBRETRY	464
BITMAP	BBYES	464
BITMAP	BLUEGLASS_BUTTON	7328
BITMAP	BLUEGLASS_CHECKBOX	468
BITMAP	BLUEGLASS_CHECKLIST	368
BITMAP	BLUEGLASS_PROGRESSBAR	1104
BITMAP	BLUEGLASS_RADIOBUTTON	468
BITMAP	BLUEGLASS_SCROLLBAR_BUTTON	936
BITMAP	BLUEGLASS_SCROLLBAR_TRACK	1448
BITMAP	BLUEGLASS_SIDECHENNEL_BAR	188
BITMAP	BLUEGLASS_SIDECHENNEL_HANDLE	1752
BITMAP	BLUEGLASS_TAB	308
BITMAP	BLUEGLASS_TAB_LINE	144
BITMAP	BLUEGLASS_TITLEBTN	3372
BITMAP	BLUEGLASS_TITLE_CLIENT	7004
BITMAP	BLUEGLASS_TITLE_LEFT	6476
BITMAP	BLUEGLASS_TITLE_RIGHT	4496
BITMAP	BLUEGLASS_TRACKBAR_BAR	586
BITMAP	BLUEGLASS_TRACKBAR_SLIDER	762
BITMAP	BLUEGLASS_TRACKBAR_SLIDER_V	766
BITMAP	DBEDIT	92
BITMAP	DBGARROW	92
BITMAP	DBINSERT	92
BITMAP	DBMULTIARROW	92
BITMAP	DBMULTIDOT	92
BITMAP	DBNAV_BUTTON	3624
BITMAP	DBN_CANCEL	312
BITMAP	DBN_DELETE	312
BITMAP	DBN_EDIT	312
BITMAP	DBN_FIRST	312
BITMAP	DBN_INSERT	312
BITMAP	DBN_LAST	312
BITMAP	DBN_NEXT	260
BITMAP	DBN_POST	312
BITMAP	DBN_PRIOR	260
BITMAP	DBN_REFRESH	312
BITMAP	DEEPBLUE_BUTTON	2456
BITMAP	DEEPBLUE_CHECKBOX	468
BITMAP	DEEPBLUE_CHECKLIST	368
BITMAP	DEEPBLUE_PROGRESSBAR	1104
BITMAP	DEEPBLUE_RADIOBUTTON	468
BITMAP	DEEPBLUE_SCROLLBAR_BUTTON	872
BITMAP	DEEPBLUE_SCROLLBAR_TRACK	296
BITMAP	DEEPBLUE_SIDECHENNEL_BAR	184
BITMAP	DEEPBLUE_SIDECHENNEL_HANDLE	436
BITMAP	DEEPBLUE_TAB	240
BITMAP	DEEPBLUE_TAB_LINE	124
BITMAP	DEEPBLUE_TITLEBTN	3372
BITMAP	DEEPBLUE_TITLE_CLIENT	1768
BITMAP	DEEPBLUE_TITLE_LEFT	4264
BITMAP	DEEPBLUE_TITLE_RIGHT	4264
BITMAP	DEEPBLUE_TRACKBAR_BAR	586
BITMAP	DEEPBLUE_TRACKBAR_SLIDER	762
BITMAP	DEEPBLUE_TRACKBAR_SLIDER_V	458
BITMAP	FONTCOMBO_DEVICE_FNT	248
BITMAP	FONTCOMBO_TRUETYPE_FNT	248
BITMAP	MACOS_BUTTON	6860
BITMAP	MACOS_CHECKBOX	2084
BITMAP	MACOS_CHECKLIST	1504
BITMAP	MACOS_COMBOBOX_BUTTON	1336
BITMAP	MACOS_FORM_BACKGROUND	136
BITMAP	MACOS_MENU_BAR	192
BITMAP	MACOS_MENU_SELECT	1148
BITMAP	MACOS_PROGRESSBAR	1224
BITMAP	MACOS_RADIOBUTTON	2152
BITMAP	MACOS_SCROLLBAR_BUTTON	3176
BITMAP	MACOS_SCROLLBAR_TRACK	1640
BITMAP	MACOS_SCROLLBUTTON	2360
BITMAP	MACOS_SIDECHENNEL_BAR	1148
BITMAP	MACOS_SIDECHENNEL_HANDLE	1736
BITMAP	MACOS_TAB	2036
BITMAP	MACOS_TAB_LINE	1204
BITMAP	MACOS_TITLEBTN	15682
BITMAP	MACOS_TITLE_CLIENT	2260
BITMAP	MACOS_TITLE_LEFT	2168
BITMAP	MACOS_TITLE_RIGHT	2168
BITMAP	MACOS_TRACKBAR_BAR	722
BITMAP	MACOS_TRACKBAR_SLIDER	762
BITMAP	MACOS_TRACKBAR_SLIDER_V	602
ICON	#1	16936
ICON	#2	9640
GROUP_ICON	MAINICON	34
VERSION	#1	736
MANIFEST	#1	358

module_name	hint	ord	function_name
kernel32.dll			GetProcAddress
kernel32.dll			GetModuleHandleA
kernel32.dll			LoadLibraryA
user32.dll			GetKeyboardType
advapi32.dll			RegQueryValueExA
oleaut32.dll			SysFreeString
advapi32.dll			RegQueryValueExA
version.dll			VerQueryValueA
gdi32.dll			UnrealizeObject
user32.dll			CreateWindowExA
ole32.dll			CoTaskMemFree
oleaut32.dll			SafeArrayPtrOfIndex
ole32.dll			CreateStreamOnHGlobal
oleaut32.dll			GetErrorInfo
comctl32.dll			ImageList_SetIconSize
shell32.dll			Shell_NotifyIconA
shell32.dll			SHGetSpecialFolderLocation
comdlg32.dll			GetOpenFileNameA
iphlpapi.dll			GetAdaptersInfo

StringTable 080403A8

CompanyName	www.xiaobaixitong.com
FileDescription	小白一键重装系统
FileVersion	3.2.2.0
InternalName	小白一键重装系统
LegalCopyright	小白一键重装系统
LegalTrademarks	XiaoBaiXT
OriginalFilename	小白一键重装系统
ProductName	小白一键重装系统
ProductVersion	3.2.2.0

VS_FIXEDFILEINFO

FileVersion	3.2.2.0
ProductVersion	3.2.2.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	5391408	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x701400

[?] can't find file_offset of VA 0x74b040

[?] can't find file_offset of VA 0x787a08

[?] can't find file_offset of VA 0x79d808

[?] can't find file_offset of VA 0x7b3fb8

[?] can't find file_offset of VA 0xb08980

[?] can't find file_offset of VA 0xb089a8

[?] can't find file_offset of VA 0xb08adc

[?] can't find file_offset of VA 0xb08c10

[?] can't find file_offset of VA 0xb08d44

[?] can't find file_offset of VA 0xb08e78

[?] can't find file_offset of VA 0xb08fac

[?] can't find file_offset of VA 0xb090e0

[?] can't find file_offset of VA 0xb09214

[?] can't find file_offset of VA 0xb093e4

[?] can't find file_offset of VA 0xb095c8

[?] can't find file_offset of VA 0xb09798

[?] can't find file_offset of VA 0xb09968

[?] can't find file_offset of VA 0xb09b38

[?] can't find file_offset of VA 0xb09d08

[?] can't find file_offset of VA 0xb09ed8

[?] can't find file_offset of VA 0xb0a0a8

[?] can't find file_offset of VA 0xb0a278

[?] can't find file_offset of VA 0xb0a448

[?] can't find file_offset of VA 0xb0c0e8

[?] can't find file_offset of VA 0xb0c2bc

[?] can't find file_offset of VA 0xb0c42c

[?] can't find file_offset of VA 0xb0c87c

[?] can't find file_offset of VA 0xb0ca50

[?] can't find file_offset of VA 0xb0cdf8

[?] can't find file_offset of VA 0xb0d3a0

[?] can't find file_offset of VA 0xb0d45c

[?] can't find file_offset of VA 0xb0db34

[?] can't find file_offset of VA 0xb0dc68

[?] can't find file_offset of VA 0xb0dcf8

[?] can't find file_offset of VA 0xb0ea24

[?] can't find file_offset of VA 0xb10580

[?] can't find file_offset of VA 0xb11ecc

[?] can't find file_offset of VA 0xb1305c

[?] can't find file_offset of VA 0xb132a8

[?] can't find file_offset of VA 0xb135a4

[?] can't find file_offset of VA 0xb138a4

[?] can't find file_offset of VA 0xb13900

[?] can't find file_offset of VA 0xb1395c

[?] can't find file_offset of VA 0xb139b8

[?] can't find file_offset of VA 0xb13a14

[?] can't find file_offset of VA 0xb13a70

[?] can't find file_offset of VA 0xb14898

[?] can't find file_offset of VA 0xb149d0

[?] can't find file_offset of VA 0xb14b08

[?] can't find file_offset of VA 0xb14c40

[?] can't find file_offset of VA 0xb14d78

[?] can't find file_offset of VA 0xb14eb0

[?] can't find file_offset of VA 0xb14fe8

[?] can't find file_offset of VA 0xb150ec

[?] can't find file_offset of VA 0xb15224

[?] can't find file_offset of VA 0xb15328

[?] can't find file_offset of VA 0xb15460

[?] can't find file_offset of VA 0xb15df8

[?] can't find file_offset of VA 0xb15fcc

[?] can't find file_offset of VA 0xb1613c

[?] can't find file_offset of VA 0xb1658c

[?] can't find file_offset of VA 0xb16760

[?] can't find file_offset of VA 0xb16ac8

[?] can't find file_offset of VA 0xb16bf0

[?] can't find file_offset of VA 0xb16ca8

[?] can't find file_offset of VA 0xb16e5c

[?] can't find file_offset of VA 0xb16f4c

[?] can't find file_offset of VA 0xb16fc8

[?] can't find file_offset of VA 0xb17cf4

[?] can't find file_offset of VA 0xb183dc

[?] can't find file_offset of VA 0xb19484

[?] can't find file_offset of VA 0xb1a52c

[?] can't find file_offset of VA 0xb1a778

[?] can't find file_offset of VA 0xb1aa74

[?] can't find file_offset of VA 0xb1ac40

[?] can't find file_offset of VA 0xb1ad38

[?] can't find file_offset of VA 0xb1ae30

[?] can't find file_offset of VA 0xb1c8fc

[?] can't find file_offset of VA 0xb1d120

[?] can't find file_offset of VA 0xb1d700

[?] can't find file_offset of VA 0xb1dc38

[?] can't find file_offset of VA 0xb1dcc0

[?] can't find file_offset of VA 0xb1dd80

[?] can't find file_offset of VA 0xb1e1fc

[?] can't find file_offset of VA 0xb1e6c4

[?] can't find file_offset of VA 0xb1ef2c

[?] can't find file_offset of VA 0xb1fb94

[?] can't find file_offset of VA 0xb201fc

[?] can't find file_offset of VA 0xb20b34

[?] can't find file_offset of VA 0xb20fb0

[?] can't find file_offset of VA 0xb21678

[?] can't find file_offset of VA 0xb21e6c

[?] can't find file_offset of VA 0xb22320

[?] can't find file_offset of VA 0xb26064

[?] can't find file_offset of VA 0xb26938

[?] can't find file_offset of VA 0xb271b0

[?] can't find file_offset of VA 0xb27a28

[?] can't find file_offset of VA 0xb27cfc

[?] can't find file_offset of VA 0xb27ff8

[?] can't find file_offset of VA 0xb28254

[?] too many errors getting resource data, stopped on 0 of 1

[?] can't find file_offset of VA 0x0

1111.exe- 小白一键重装系统 - 小白一键重装系统