filenameHelbreath ArgentinaT.exe
size4862609 (0x4a3291)
md5a56538dc2adee03864a46de3ebbb2c75
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x130

Rich Header

lib idversiontimes used
147210224
150204134
149210224
1312102220
1235072710
21816842
2281689
1189661
1990499
002
1980346
484473
10211
1322102231
146210221
148210221
145210221

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0xa
TimeDateStamp0x5d291c2f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion9.0
SizeOfCode0x10c600
SizeOfInitializedData0x20e00
SizeOfUninitializedData0
AddressOfEntryPoint0x1ab2058
BaseOfCode0x1000
BaseOfData0x10e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x1ee3000
SizeOfHeaders0x400
CheckSum0x4afcb2
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
0x10000x10c4180x60560R-X CODE
0x10e0000x160540x7a50R-- IDATA
0x1250000xad8640x47fRW- IDATA
0x1d30000x1a180xa4fR-- IDATA
0x1d50000x84460x58edR-- IDATA DISCARDABLE
.exports0x1de0000x22000x2200R-- IDATA
.imports0x1e10000x10000x400RW- IDATA
.rsrc0x1e20000x12000x1200R-- IDATA
.themida0x1e40000x18ce0000RWX CODE IDATA
.boot0x1ab20000x430a000x430891R-X CODE IDATA

Data Directory

typevasize
EXPORT0x1de0000x2154
IMPORT0x1e11600x1a0
RESOURCE0x1e20000x1028
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#122160
GROUP_ICON#129200
VERSION#19960
MANIFEST#15980
module_namehintordfunction_name
kernel32.dllGetModuleHandleA
search.dll1
HBARG.dlltimeGetTime
WSOCK32.dll22
DINPUT.dllDirectInputCreateA
DSOUND.dll1
DDRAW.dllDirectDrawCreateEx
IMM32.dllImmGetContext
USER32.dllGetCursorPos
GDI32.dllSelectObject
ADVAPI32.dllRegSetValueExA
SHELL32.dllShellExecuteA
MSVCR90.dll_cexit
MSVCP90.dllpublic: __thiscall std::ios_base::Init::Init(void)

??0Init@ios_base@std@@QAE@XZ

ordentry_vafunction_name
10xea2e0??0CxExifInfo@CxImageJPG@@QAE@PAUtag_ExifInfo@1@@Z
20xe2870??0CxFile@@QAE@ABV0@@Z
30xe2800??0CxFile@@QAE@XZ
40xe2cc0??0CxIOFile@@QAE@ABV0@@Z
50xe2910??0CxIOFile@@QAE@PAU_iobuf@@@Z
60xe3220??0CxImage@@QAE@ABV0@_N11@Z
70xe309f??0CxImage@@QAE@K@Z
80xe31e3??0CxImage@@QAE@KKKK@Z
90xe4b11??0CxImage@@QAE@PAEKK@Z
100xe4aa7??0CxImage@@QAE@PAU_iobuf@@K@Z
110xe4adc??0CxImage@@QAE@PAVCxFile@@K@Z
120xe4a72??0CxImage@@QAE@PBDK@Z
130xe4120??0CxImageJPG@@QAE@ABV0@@Z
140xe8eb0??0CxImageJPG@@QAE@XZ
150xe2dd0??0CxMemFile@@QAE@ABV0@@Z
160xe54e0??0CxMemFile@@QAE@PAEK@Z
170xea389??1CxExifInfo@CxImageJPG@@QAE@XZ
180xe2820??1CxFile@@UAE@XZ
190xe2950??1CxIOFile@@UAE@XZ
200x1830??1CxImage@@UAE@XZ
210xe8ef7??1CxImageJPG@@UAE@XZ
220xe5535??1CxMemFile@@UAE@XZ
230xe40d0??4CxExifInfo@CxImageJPG@@QAEAAV01@ABV01@@Z
240xe2890??4CxFile@@QAEAAV0@ABV0@@Z
250xe2d00??4CxIOFile@@QAEAAV0@ABV0@@Z
260xe342f??4CxImage@@QAEAAV0@ABV0@@Z
270xe41e0??4CxImageJPG@@QAEAAV0@ABV0@@Z
280xe2e40??4CxMemFile@@QAEAAV0@ABV0@@Z
290xecef0??4CxPoint2@@QAEAAV0@ABV0@@Z
300xecf10??4CxRect2@@QAEAAV0@ABV0@@Z
310x11caa8??_7CxFile@@6B@
320x11cad8??_7CxIOFile@@6B@
330x10e3e0??_7CxImage@@6B@
340x11cb38??_7CxImageJPG@@6B@
350x11cb08??_7CxMemFile@@6B@
360xe4100??_FCxExifInfo@CxImageJPG@@QAEXXZ
370xe2d40??_FCxIOFile@@QAEXXZ
380xe2f30??_FCxImage@@QAEXXZ
390xe2ea0??_FCxMemFile@@QAEXXZ
400xe2f50??_OCxImage@@QAEXABV0@@Z
410xe5994?Alloc@CxMemFile@@IAEXK@Z
420xe3939?Bitfield2RGB@CxImage@@IAEXPAEGGGE@Z
430xe6ad4?BlendPalette@CxImage@@QAEXKJ@Z
440xe641b?BlendPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@M_N@Z
450xe60db?BlindGetPixelColor@CxImage@@IAE?AUtagRGBQUAD@@JJ@Z
460xe5e70?BlindGetPixelIndex@CxImage@@IAEEJJ@Z
470xe6fd9?BlindGetPixelPointer@CxImage@@IAEPAXJJ@Z
480xe3733?Clear@CxImage@@QAEXE@Z
490xe2a00?Close@CxIOFile@@UAE_NXZ
500xe5586?Close@CxMemFile@@UAE_NXZ
510xe3ee0?CompareColors@CxImage@@KAHPBX0@Z
520xeb727?ConvertAnyFormat@CxExifInfo@CxImageJPG@@IAENPAXH@Z
530xe3262?Copy@CxImage@@QAEXABV1@_N11@Z
540xe33fe?CopyInfo@CxImage@@IAEXABV1@@Z
550xe3459?Create@CxImage@@QAEPAXKKKK@Z
560xe3bf5?CreateFromArray@CxImage@@QAE_NPAEKKKK_N@Z
570xe3d67?CreateFromMatrix@CxImage@@QAE_NPAPAEKKKK_N@Z
580xe4b8d?Decode@CxImage@@QAE_NPAEKK@Z
590xe4bf7?Decode@CxImage@@QAE_NPAU_iobuf@@K@Z
600xe4c5d?Decode@CxImage@@QAE_NPAVCxFile@@K@Z
610xe3f80?Decode@CxImageJPG@@QAE_NPAU_iobuf@@@Z
620xe9051?Decode@CxImageJPG@@QAE_NPAVCxFile@@@Z
630xea400?DecodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@H@Z
640xe4060?DecodeExif@CxImageJPG@@QAE_NPAU_iobuf@@@Z
650xe8f7c?DecodeExif@CxImageJPG@@QAE_NPAVCxFile@@@Z
660xe30c4?Destroy@CxImage@@QAE_NXZ
670xebb54?DiscardAllButExif@CxExifInfo@CxImageJPG@@QAEXXZ
680xe7015?DrawLine@CxImage@@QAEXHHHHK@Z
690xe7051?DrawLine@CxImage@@QAEXHHHHUtagRGBQUAD@@_N@Z
700xe5452?Enable@CxImage@@QAEX_N@Z
710xe4711?Encode2RGBA@CxImage@@QAE_NAAPAEAAJ@Z
720xe47d9?Encode2RGBA@CxImage@@QAE_NPAVCxFile@@@Z
730xe4415?Encode@CxImage@@QAE_NAAPAEAAJK@Z
740xe43af?Encode@CxImage@@QAE_NPAU_iobuf@@K@Z
750xe4680?Encode@CxImage@@QAE_NPAU_iobuf@@PAPAV1@HK@Z
760xe44e1?Encode@CxImage@@QAE_NPAVCxFile@@K@Z
770xe46ee?Encode@CxImage@@QAE_NPAVCxFile@@PAPAV1@HK@Z
780xe3ff0?Encode@CxImageJPG@@QAE_NPAU_iobuf@@@Z
790xe9868?Encode@CxImageJPG@@QAE_NPAVCxFile@@@Z
800xeba16?EncodeExif@CxExifInfo@CxImageJPG@@QAE_NPAVCxFile@@@Z
810xe4310?EncodeSafeCheck@CxImage@@IAE_NPAVCxFile@@@Z
820xe2be0?Eof@CxIOFile@@UAE_NXZ
830xe5874?Eof@CxMemFile@@UAE_NXZ
840xe2c10?Error@CxIOFile@@UAEJXZ
850xe589f?Error@CxMemFile@@UAEJXZ
860xebce7?FindSection@CxExifInfo@CxImageJPG@@IAEPAXH@Z
870xed404?Flip@CxImage@@QAE_NXZ
880xe2bb0?Flush@CxIOFile@@UAE_NXZ
890xe585a?Flush@CxMemFile@@UAE_NXZ
900xe5a05?Free@CxMemFile@@IAEXXZ
910xe3f5c?FreeMemory@CxImage@@QAEXPAX@Z
920xeab27?Get16m@CxExifInfo@CxImageJPG@@IAEHPAX@Z
930xeab4a?Get16u@CxExifInfo@CxImageJPG@@IAEHPAX@Z
940xeab91?Get32s@CxExifInfo@CxImageJPG@@IAEJPAX@Z
950xeac06?Get32u@CxExifInfo@CxImageJPG@@IAEKPAX@Z
960xe365b?GetBits@CxImage@@QAEPAEK@Z
970xe52d3?GetBpp@CxImage@@QBEGXZ
980xe5628?GetBuffer@CxMemFile@@QAEPAE_N@Z
990xe2c90?GetC@CxIOFile@@UAEJXZ
1000xe594e?GetC@CxMemFile@@UAEJXZ
1010xe6f35?GetClrImportant@CxImage@@QBEKXZ
1020xe520f?GetCodecOption@CxImage@@QAEKK@Z
1030xe50cb?GetColorType@CxImage@@QAEEXZ
1040xe527e?GetDIB@CxImage@@QBEPAXXZ
1050xe52b1?GetEffWidth@CxImage@@QBEKXZ
1060xe53df?GetEscape@CxImage@@QBEJXZ
1070xe51c2?GetFlags@CxImage@@QBEKXZ
1080xe547f?GetFrame@CxImage@@QBEJXZ
1090xe52f6?GetFrameDelay@CxImage@@QBEKXZ
1100xe528f?GetHeight@CxImage@@QBEKXZ
1110xe5371?GetJpegQuality@CxImage@@QBEEXZ
1120xe539e?GetJpegScale@CxImage@@QBEEXZ
1130xe54ac?GetLastError@CxImage@@QAEPBDXZ
1140xe6562?GetNearestIndex@CxImage@@QAEEUtagRGBQUAD@@@Z
1150xe52c2?GetNumColors@CxImage@@QBEKXZ
1160xe546b?GetNumFrames@CxImage@@QBEJXZ
1170xe5323?GetOffset@CxImage@@QAEXPAJ0@Z
1180xe5c25?GetPalette@CxImage@@QBEPAUtagRGBQUAD@@XZ
1190xe5c4f?GetPaletteColor@CxImage@@QAE?AUtagRGBQUAD@@E@Z
1200xe67d7?GetPaletteColor@CxImage@@QAE_NEPAE00@Z
1210xe5a20?GetPaletteSize@CxImage@@QAEKXZ
1220xe5f7f?GetPixelColor@CxImage@@QAE?AUtagRGBQUAD@@JJ_N@Z
1230xe6172?GetPixelGray@CxImage@@QAEEJJ@Z
1240xe5cfd?GetPixelIndex@CxImage@@QAEEJJ@Z
1250xe53cb?GetProgress@CxImage@@QBEJXZ
1260xe36cc?GetSize@CxImage@@QAEJXZ
1270xe4ff0?GetTransColor@CxImage@@QAE?AUtagRGBQUAD@@XZ
1280xe504c?GetTransIndex@CxImage@@QBEJXZ
1290xe52e5?GetType@CxImage@@QBEKXZ
1300xe54ce?GetVersion@CxImage@@QAEPBDXZ
1310xe54bd?GetVersionNumber@CxImage@@QAE?BMXZ
1320xe52a0?GetWidth@CxImage@@QBEKXZ
1330xe50f0?GetXDPI@CxImage@@QBEJXZ
1340xe5104?GetYDPI@CxImage@@QBEJXZ
1350xe38a8?Ghost@CxImage@@IAEXPAV1@@Z
1360xecf40?GrayScale@CxImage@@QAE_NXZ
1370xe543e?IsEnabled@CxImage@@QBE_NXZ
1380xe6c0a?IsGrayScale@CxImage@@QAE_NXZ
1390xe50b2?IsIndexed@CxImage@@QBE_NXZ
1400xe36ef?IsInside@CxImage@@QAE_NJJ@Z
1410xe6e3d?IsSamePalette@CxImage@@QAE_NAAV1@_N@Z
1420xe6db1?IsTransparent@CxImage@@QAE_NJJ@Z
1430xe5096?IsTransparent@CxImage@@QBE_NXZ
1440xe5425?IsValid@CxImage@@QBE_NXZ
1450xe48a0?Load@CxImage@@QAE_NPBDK@Z
1460xe49b3?LoadResource@CxImage@@QAE_NPAUHRSRC__@@KPAUHINSTANCE__@@@Z
1470xed55d?Mirror@CxImage@@QAE_NXZ
1480xee374?Negative@CxImage@@QAE_NXZ
1490xe29b0?Open@CxIOFile@@QAE_NPBD0@Z
1500xe55cc?Open@CxMemFile@@QAE_NXZ
1510xeac1f?ProcessExifDir@CxExifInfo@CxImageJPG@@IAE_NPAE0IQAUtag_ExifInfo@2@QAPAE@Z
1520xe2840?PutC@CxFile@@UAE_NE@Z
1530xe2c40?PutC@CxIOFile@@UAE_NE@Z
1540xe58cb?PutC@CxMemFile@@UAE_NE@Z
1550xe67ae?RGBQUADtoRGB@CxImage@@SAKUtagRGBQUAD@@@Z
1560xe66fd?RGBtoBGR@CxImage@@IAEXPAEH@Z
1570xe6781?RGBtoRGBQUAD@CxImage@@SA?AUtagRGBQUAD@@K@Z
1580xe2a50?Read@CxIOFile@@UAEIPAXII@Z
1590xe564e?Read@CxMemFile@@UAEIPAXII@Z
1600xed7d7?RotateLeft@CxImage@@QAE_NPAV1@@Z
1610xeddb4?RotateRight@CxImage@@QAE_NPAV1@@Z
1620xe435e?Save@CxImage@@QAE_NPBDK@Z
1630xe2ad0?Seek@CxIOFile@@UAE_NJH@Z
1640xe57a8?Seek@CxMemFile@@UAE_NJH@Z
1650xe6f46?SetClrImportant@CxImage@@QAEXK@Z
1660xe5244?SetCodecOption@CxImage@@QAE_NKK@Z
1670xe540c?SetEscape@CxImage@@QAEXJ@Z
1680xe51d6?SetFlags@CxImage@@QAEXK_N@Z
1690xe5493?SetFrame@CxImage@@QAEXJ@Z
1700xe530a?SetFrameDelay@CxImage@@QAEXK@Z
1710xe6a3e?SetGrayPalette@CxImage@@QAEXXZ
1720xe5385?SetJpegQuality@CxImage@@QAEXE@Z
1730xe53b2?SetJpegScale@CxImage@@QAEXE@Z
1740xe534c?SetOffset@CxImage@@QAEXJJ@Z
1750xe683a?SetPalette@CxImage@@QAEXKPAE00@Z
1760xe6906?SetPalette@CxImage@@QAEXPAUrgb_color@1@K@Z
1770xe69ca?SetPalette@CxImage@@QAEXPAUtagRGBQUAD@@K@Z
1780xe5a34?SetPaletteColor@CxImage@@QAEXEEEEE@Z
1790xe5b76?SetPaletteColor@CxImage@@QAEXEK@Z
1800xe5ad5?SetPaletteColor@CxImage@@QAEXEUtagRGBQUAD@@@Z
1810xe633c?SetPixelColor@CxImage@@QAEXJJK@Z
1820xe6370?SetPixelColor@CxImage@@QAEXJJUtagRGBQUAD@@_N@Z
1830xe61cc?SetPixelIndex@CxImage@@QAEXJJE@Z
1840xe53f3?SetProgress@CxImage@@QAEXJ@Z
1850xe71d4?SetStdPalette@CxImage@@QAEXXZ
1860xe5079?SetTransColor@CxImage@@QAEXUtagRGBQUAD@@@Z
1870xe5060?SetTransIndex@CxImage@@QAEXJ@Z
1880xe5118?SetXDPI@CxImage@@QAEXJ@Z
1890xe516d?SetYDPI@CxImage@@QAEXJ@Z
1900xe2b40?Size@CxIOFile@@UAEJXZ
1910xe583b?Size@CxMemFile@@UAEJXZ
1920xe2ff0?Startup@CxImage@@IAEXK@Z
1930xe6c95?SwapIndex@CxImage@@QAEXEE@Z
1940xe2b10?Tell@CxIOFile@@UAEJXZ
1950xe581c?Tell@CxMemFile@@UAEJXZ
1960xe37b2?Transfer@CxImage@@QAE_NAAV1@@Z
1970xe2a90?Write@CxIOFile@@UAEIPBXII@Z
1980xe56fc?Write@CxMemFile@@UAEIPBXII@Z
1990xeb889?process_COM@CxExifInfo@CxImageJPG@@IAEXPBEH@Z
2000xea954?process_EXIF@CxExifInfo@CxImageJPG@@IAE_NPAEI@Z
2010xeb998?process_SOFn@CxExifInfo@CxImageJPG@@IAEXPBEH@Z
module_nameHelbreath Argentina.exe
flags0
timestamp2019-07-12 23:47:59
version0.0
ordinal_base1
nFunctions201
nNames201
Names(201)0x1dfe30
Functions(201)0x1dfb0c
NameOrdinals(201)0x1df97a

StringTable 2c0a04b0

CommentsHelbreath Argentina
CompanyNameVersion 8.00
FileDescriptionHelbreath Argentina
FileVersion8.00
InternalNameHelbreath Argentina
LegalCopyrightVersion 8.00
LegalTrademarksArgentina..com
OriginalFilenameHelbreath Argentina
PrivateBuild8.00
ProductNameHelabreath Argentina
ProductVersion8.00
SpecialBuildHelbreath Argentina

VS_FIXEDFILEINFO

FileVersion8.0.0.0
ProductVersion8.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0x28
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d04857025BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK