1.unpacked.exe - Wizard.EXE - Wizard MFC Application

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

parent	1.exe
filename	1.unpacked.exe
size	39424 (0x9a00)
md5	8e3f51589812201d027faccfaec2df16

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
95	2190	2
14	7299	1
10	8047	11
4	8047	2
4	9782	2
1	0	152
93	2179	13
11	9782	6
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x5167b556
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x3400
SizeOfInitializedData	0x6200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4070
BaseOfCode	0x1000
BaseOfData	0x5000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xc000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x3292	0x3400	R-X CODE
.rdata	0x5000	0xc7c	0xe00	R-- IDATA
.data	0x6000	0x9ac	0x600	RW- IDATA
.rsrc	0x7000	0x4d14	0x4e00	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x54e8	0xb4
RESOURCE	0x7000	0x4d14
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
DIALOG	#101	9215	1252
DIALOG	#102	9215	1252
DIALOG	#102	160	1252
VERSION	#1	844	1252

module_name	ord	function_name
KERNEL32.DLL		CloseHandle
KERNEL32.DLL		CreateFileA
KERNEL32.DLL		MultiByteToWideChar
KERNEL32.DLL		MoveFileExA
KERNEL32.DLL		DeleteFileA
KERNEL32.DLL		GetThreadContext
KERNEL32.DLL		TerminateProcess
KERNEL32.DLL		VirtualProtectEx
KERNEL32.DLL		GetCommandLineA
KERNEL32.DLL		GetModuleHandleA
KERNEL32.DLL		VirtualAlloc
KERNEL32.DLL		LockResource
KERNEL32.DLL		Process32Next
KERNEL32.DLL		CreateToolhelp32Snapshot
KERNEL32.DLL		ReadFile
KERNEL32.DLL		GetFileSize
KERNEL32.DLL		GetStartupInfoA
KERNEL32.DLL		FreeLibrary
KERNEL32.DLL		VirtualAllocEx
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		LoadLibraryA
ADVAPI32.dll		RegCreateKeyA
ADVAPI32.dll		RegCloseKey
ADVAPI32.dll		RegOpenKeyExA
ADVAPI32.dll		RegQueryValueExA
MFC42.DLL	3136
MFC42.DLL	3262
MFC42.DLL	2985
MFC42.DLL	3081
MFC42.DLL	2976
MFC42.DLL	3830
MFC42.DLL	3831
MFC42.DLL	3825
MFC42.DLL	3079
MFC42.DLL	4080
MFC42.DLL	4622
MFC42.DLL	4424
MFC42.DLL	3738
MFC42.DLL	561
MFC42.DLL	825
MFC42.DLL	815
MFC42.DLL	641
MFC42.DLL	2514
MFC42.DLL	5265
MFC42.DLL	4853
MFC42.DLL	4998
MFC42.DLL	6052
MFC42.DLL	4078
MFC42.DLL	1775
MFC42.DLL	4407
MFC42.DLL	5241
MFC42.DLL	4465
MFC42.DLL	5163
MFC42.DLL	6374
MFC42.DLL	4353
MFC42.DLL	5280
MFC42.DLL	3798
MFC42.DLL	4837
MFC42.DLL	4441
MFC42.DLL	2648
MFC42.DLL	2055
MFC42.DLL	6376
MFC42.DLL	3749
MFC42.DLL	5065
MFC42.DLL	1727
MFC42.DLL	5261
MFC42.DLL	2446
MFC42.DLL	2124
MFC42.DLL	5277
MFC42.DLL	4627
MFC42.DLL	4425
MFC42.DLL	3597
MFC42.DLL	324
MFC42.DLL	4234
MFC42.DLL	4710
MFC42.DLL	2379
MFC42.DLL	755
MFC42.DLL	1168
MFC42.DLL	4376
MFC42.DLL	823
MFC42.DLL	3259
MFC42.DLL	3147
MFC42.DLL	2982
MFC42.DLL	5714
MFC42.DLL	5289
MFC42.DLL	5307
MFC42.DLL	4698
MFC42.DLL	4079
MFC42.DLL	2725
MFC42.DLL	5302
MFC42.DLL	5300
MFC42.DLL	3346
MFC42.DLL	2396
MFC42.DLL	5199
MFC42.DLL	1089
MFC42.DLL	3922
MFC42.DLL	5731
MFC42.DLL	2512
MFC42.DLL	2554
MFC42.DLL	4486
MFC42.DLL	6375
MFC42.DLL	4274
MFC42.DLL	4673
MFC42.DLL	1576
MFC42.DLL	2385
MFC42.DLL	470
MSVCRT.dll		__p__commode
MSVCRT.dll		__p__fmode
MSVCRT.dll		__set_app_type
MSVCRT.dll		_except_handler3
MSVCRT.dll		_controlfp
MSVCRT.dll		_adjust_fdiv
MSVCRT.dll		__setusermatherr
MSVCRT.dll		_initterm
MSVCRT.dll		__getmainargs
MSVCRT.dll		_acmdln
MSVCRT.dll		exit
MSVCRT.dll		_XcptFilter
MSVCRT.dll		_exit
MSVCRT.dll		_onexit
MSVCRT.dll		__dllonexit
MSVCRT.dll		_snprintf
MSVCRT.dll		_strlwr
MSVCRT.dll		__p__pgmptr
MSVCRT.dll		sprintf
MSVCRT.dll		strrchr
MSVCRT.dll		malloc
MSVCRT.dll		free
MSVCRT.dll		time
MSVCRT.dll		srand
MSVCRT.dll		rand
MSVCRT.dll		strncpy
MSVCRT.dll		_setmbcp
MSVCRT.dll		__CxxFrameHandler
MSVCRT.dll		strstr
MSVCRT.dll		strncat
ole32.dll		CoInitialize
ole32.dll		CoCreateInstance
ole32.dll		CoUninitialize
SHELL32.dll		SHGetSpecialFolderPathA
USER32.dll		GetSystemMetrics
USER32.dll		GetClientRect
USER32.dll		DrawIcon
USER32.dll		SendMessageA
USER32.dll		EnableWindow
USER32.dll		IsIconic
VERSION.dll		VerQueryValueA
VERSION.dll		GetFileVersionInfoA
VERSION.dll		GetFileVersionInfoSizeA

StringTable 040904b0

Comments
CompanyName
FileDescription	Wizard MFC Application
FileVersion	1, 0, 0, 1
InternalName	Wizard
LegalCopyright	Copyright (C) 2013
LegalTrademarks
OriginalFilename	Wizard.EXE
PrivateBuild
ProductName	Wizard Application
ProductVersion	1, 0, 0, 1
SpecialBuild

VS_FIXEDFILEINFO

FileVersion	1.0.0.1
ProductVersion	1.0.0.1
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	39424	EXE	04/12/2013 07:18:46	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

1.unpacked.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

1.unpacked.exe
-