qip.exe

info
MZ
PE
resources
strings
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	qip.exe
size	18692016 (0x11d37b0)
md5	8fb32c787d10fc22fff0bc7ce59323d1

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000b0: 00 00 00 00 00 00 00 00  00 00 00 00 b4 c2 ca 94  |................|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x2a425e19
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x33fe00
SizeOfInitializedData	0x3c9400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x340b2c
BaseOfCode	0x1000
BaseOfData	0x341000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x70ea00
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
CODE	0x1000	0x33fcbc	0x33fe00	R-X CODE
DATA	0x341000	0x18a38	0x18c00	RW- IDATA
BSS	0x35a000	0x201	0	RW-
.idata	0x35b000	0x58a	0x600	RW- IDATA
.tls	0x35c000	0x40	0	RW-
.rdata	0x35d000	0x18	0x200	R-- IDATA SHARED
.reloc	0x35e000	0xe68	0x1000	R-- IDATA SHARED
.rsrc	0x35f000	0x3af000	0x3af000	R-- IDATA SHARED

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x35b000	0x58a
RESOURCE	0x35f000	0x3aebb4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x35e000	0xe68
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x35d000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x75c000	0x75c040	0x75a000	0x75d010	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
CURSOR	#5	308
CURSOR	#6	308
CURSOR	#7	308
ICON	#1	1128
STRING	#4084	32
STRING	#4085	32
STRING	#4086	32
STRING	#4087	32
STRING	#4088	32
STRING	#4089	32
STRING	#4090	32
STRING	#4091	32
STRING	#4092	32
STRING	#4093	32
STRING	#4094	32
STRING	#4095	32
STRING	#4096	574
RCDATA	DVCLAL	16
RCDATA	PACKAGEINFO	92
RCDATA	TFORM1	434
RCDATA	#1	3853746
GROUP_CURSOR	#32761	20
GROUP_CURSOR	#32762	20
GROUP_CURSOR	#32763	20
GROUP_CURSOR	#32764	20
GROUP_CURSOR	#32765	20
GROUP_CURSOR	#32766	20
GROUP_CURSOR	#32767	20
GROUP_ICON	#1	20
MANIFEST	#1	861

id	lang	string
65521	0	Out of memory
65522	0	I/O error %d
65523	0	File not found
65524	0	Invalid filename
65525	0	Too many open files
65526	0	File access denied
65527	0	Read beyond end of file
65529	0	Invalid numeric input
65530	0	Division by zero
65531	0	Range check error
65532	0	Integer overflow
65533	0	Invalid floating point operation
65534	0	Floating point division by zero
65535	0	Floating point overflow

module_name	hint	ord	function_name
advapi32.dll			PrivilegedServiceAuditAlarmW
advapi32.dll			AdjustTokenGroups
user32.dll			SetClassWord
user32.dll			UnhookWindowsHookEx
user32.dll			FillRect
user32.dll			CheckMenuRadioItem
user32.dll			ChangeDisplaySettingsExA
user32.dll			SetDlgItemInt
user32.dll			DefFrameProcW
user32.dll			SetWindowWord
user32.dll			SetProgmanWindow
user32.dll			BroadcastSystemMessageExW
user32.dll			GetScrollRange
user32.dll			LoadImageA
user32.dll			GetDlgItemTextW
user32.dll			SendMessageTimeoutW
user32.dll			MonitorFromRect
user32.dll			DrawCaptionTempA
user32.dll			wsprintfA
user32.dll			SetProcessWindowStation
user32.dll			EnumPropsExA
user32.dll			ScrollChildren
user32.dll			GetScrollBarInfo
user32.dll			WaitMessage
user32.dll			MessageBoxW
user32.dll			DragObject
user32.dll			TrackMouseEvent
kernel32.dll			LoadLibraryExA
kernel32.dll			CompareFileTime
kernel32.dll			GetCommandLineW
kernel32.dll			ConsoleMenuControl
kernel32.dll			FoldStringA
kernel32.dll			GetComputerNameA
kernel32.dll			WritePrivateProfileStringW
kernel32.dll			ExpungeConsoleCommandHistoryA
kernel32.dll			ReadConsoleOutputAttribute
kernel32.dll			DebugBreak
kernel32.dll			LockResource
kernel32.dll			CreateDirectoryExA
kernel32.dll			GetProcessIoCounters
kernel32.dll			DeleteTimerQueueEx
kernel32.dll			SizeofResource
kernel32.dll			GetPriorityClass
kernel32.dll			GetVersion
kernel32.dll			GlobalMemoryStatusEx
kernel32.dll			GetConsoleAliasesLengthW
kernel32.dll			GetExitCodeThread
kernel32.dll			AddAtomA
comctl32.dll			InitializeFlatSB
comctl32.dll			ImageList_GetIconSize
comctl32.dll			CreatePropertySheetPageW
comctl32.dll			UninitializeFlatSB

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	18686432	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 18692016 bytes (18 MiB)



Enter password (will not be echoed):
Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x35a000