4E12920194681C4375C04690191F3E9EE8D5F0B7258570BB72DC87AFBE3CDAFB.bin - FNVUKX.exe

info
MZ
PE
resources
imports
exports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	4E12920194681C4375C04690191F3E9EE8D5F0B7258570BB72DC87AFBE3CDAFB.bin
size	53248 (0xd000)
md5	9a8521952e98ea7157b74adb5b20f525

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
14	7299	1
10	8047	4
4	8047	2
1	0	87
93	4035	7
11	8168	9
4	8168	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x50bc1d8b
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x2000
SizeOfInitializedData	0xa000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x12000
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1d000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1c74	0	RWX CODE
.rdata	0x3000	0x8c3	0	RW- IDATA
.data	0x4000	0x5fbc	0	RW- IDATA
.vmp0	0xa000	0x56e	0	RWX CODE IDATA
.rsrc	0xb000	0x2000	0x1000	RW- IDATA
.vmp1	0xd000	0x4360	0	RWX CODE IDATA
.vmp2	0x12000	0x9eb4	0xa000	RWX CODE DISCARDABLE
.reloc	0x1c000	0x90	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x1276b	0x28
IMPORT	0x13dd4	0x78
RESOURCE	0xb000	0x1ef0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x1c000	0x90
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
CURSOR	#1	308
CURSOR	#2	308
BITMAP	#271	392
BITMAP	#280	584
BITMAP	#288	3688
MENU	#237	176
MENU	#238	118
DIALOG	#254	506
DIALOG	#260	58
ACCELERATORS	#30997	24
GROUP_CURSOR	#180	20
GROUP_CURSOR	#229	20
VERSION	#1	788
#50000	#282	42

module_name	hint	ord	function_name
KERNEL32.dll			CreateThread
USER32.dll			PeekMessageA
ADVAPI32.dll			RegCloseKey
MSVCRT.dll			_adjust_fdiv
KERNEL32.dll			GetModuleHandleA
KERNEL32.dll			GetProcAddress
KERNEL32.dll			VirtualProtect

ord	entry_va	function_name
1	0x1ff0	WahCloseApcHelper
2	0x2000	WahCloseHandleHelper
3	0x2010	WahCloseNotificationHandleHelper
4	0x2020	WahCloseSocketHandle
5	0x2030	WahCloseThread
6	0x2040	WahCompleteRequest
7	0x2050	WahCreateHandleContextTable
8	0x2060	WahCreateNotificationHandle
9	0x2070	WahCreateSocketHandle
10	0x2080	WahDestroyHandleContextTable
11	0x2090	WahDisableNonIFSHandleSupport
12	0x20a0	WahEnableNonIFSHandleSupport
13	0x20b0	WahEnumerateHandleContexts
14	0x20c0	WahInsertHandleContext
15	0x20d0	WahNotifyAllProcesses
16	0x20e0	WahOpenApcHelper
17	0x20f0	WahOpenCurrentThread
18	0x2100	WahOpenHandleHelper
19	0x2110	WahOpenNotificationHandleHelper
20	0x2120	WahQueueUserApc
21	0x2130	WahReferenceContextByHandle
22	0x2140	WahRemoveHandleContext
23	0x2150	WahWaitForNotification
24	0x1760	M

module_name	KrX.dll
flags	0
timestamp	2012-12-03 03:33:31
version	0.0
ordinal_base	1
nFunctions	24
nNames	24
Names(24)	0x12823
Functions(24)	0x12793
NameOrdinals(24)	0x127f3

StringTable 100404e4

CompanyName	pINZNE hONGZGEN
FileDescription	pINZNE hONGZGEN Application
FileVersion	1, 6, 1, 3
InternalName	FNVUKX.exe
LegalCopyright	Copyright (C) 2004-2012
OriginalFilename	FNVUKX.exe
ProductName	pINZNE hONGZGEN Application
ProductVersion	1, 6, 1, 3

VS_FIXEDFILEINFO

FileVersion	1.6.1.3
ProductVersion	1.6.1.3
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	53248	DLL	12/03/2012 03:33:31	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0xcb24

[?] can't find file_offset of VA 0xcbd4

[?] can't find file_offset of VA 0xcc4c

[?] can't find file_offset of VA 0xce48

[?] can't find file_offset of VA 0xce84

[?] can't find file_offset of VA 0xce9c

[?] can't find file_offset of VA 0xceb0

[?] can't find file_offset of VA 0xcec4

4E12920194681C4375C04690191F3E9EE8D5F0B7258570BB72DC87AFBE3CDAFB.bin-