pe_c.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	pe_c.exe
size	30720 (0x7800)
md5	b1134fc94339bbc463a30e8ff680a68f

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd8

Rich Header

lib id	version	times used
147	30729	2
123	50727	3
1	0	65
131	30729	22
132	30729	8
148	21022	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	5
TimeDateStamp	0x53bd0943
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x4400
SizeOfInitializedData	0x3200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3bc0
BaseOfCode	0x1000
BaseOfData	0x6000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0xc000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Free Pascal v1.06

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4400	0x4400	R-X CODE
.rdata	0x6000	0x20e0	0x2200	R-- IDATA
.data	0x9000	0x3bc	0x200	RW- IDATA
.rsrc	0xa000	0x2f8	0x400	R-- IDATA
.reloc	0xb000	0x626	0x800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x7b2c	0x3c
RESOURCE	0xa000	0x2f8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xb000	0x608
DEBUG	0x6130	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x79b8	0x40
Bound_IAT	0	0
IAT	0x6000	0x10c
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	663	0

module_name	hint	function_name
KERNEL32.dll	469	GetFileSizeEx
KERNEL32.dll	67	CloseHandle
KERNEL32.dll	1089	UnmapViewOfFile
KERNEL32.dll	778	MapViewOfFile
KERNEL32.dll	124	CreateFileMappingW
KERNEL32.dll	486	GetLastError
KERNEL32.dll	120	CreateFileA
KERNEL32.dll	425	GetCurrentProcess
KERNEL32.dll	1069	TerminateProcess
KERNEL32.dll	332	FreeLibrary
KERNEL32.dll	1116	VirtualQuery
KERNEL32.dll	501	GetModuleFileNameW
KERNEL32.dll	547	GetProcessHeap
KERNEL32.dll	669	HeapAlloc
KERNEL32.dll	673	HeapFree
KERNEL32.dll	591	GetSystemTimeAsFileTime
KERNEL32.dll	426	GetCurrentProcessId
KERNEL32.dll	429	GetCurrentThreadId
KERNEL32.dll	614	GetTickCount
KERNEL32.dll	852	QueryPerformanceCounter
KERNEL32.dll	1045	SetUnhandledExceptionFilter
KERNEL32.dll	753	LoadLibraryA
KERNEL32.dll	544	GetProcAddress
KERNEL32.dll	1205	lstrlenA
KERNEL32.dll	794	MultiByteToWideChar
KERNEL32.dll	1146	WideCharToMultiByte
KERNEL32.dll	180	DebugBreak
KERNEL32.dll	858	RaiseException
KERNEL32.dll	721	IsDebuggerPresent
KERNEL32.dll	698	InterlockedCompareExchange
KERNEL32.dll	1057	Sleep
KERNEL32.dll	701	InterlockedExchange
KERNEL32.dll	1086	UnhandledExceptionFilter
MSVCR90D.dll	1060	_unlock
MSVCR90D.dll	186	__dllonexit
MSVCR90D.dll	688	_lock
MSVCR90D.dll	856	_onexit
MSVCR90D.dll	404	_decode_pointer
MSVCR90D.dll	424	_except_handler4_common
MSVCR90D.dll	383	_crt_debugger_hook
MSVCR90D.dll	368	_controlfp_s
MSVCR90D.dll	71	void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCR90D.dll	576	_initterm_e
MSVCR90D.dll	575	_initterm
MSVCR90D.dll	97	_CrtDbgReportW
MSVCR90D.dll	114	_CrtSetCheckCount
MSVCR90D.dll	196	__initenv
MSVCR90D.dll	1296	exit
MSVCR90D.dll	347	_cexit
MSVCR90D.dll	138	_XcptFilter
MSVCR90D.dll	433	_exit
MSVCR90D.dll	195	__getmainargs
MSVCR90D.dll	324	_amsg_exit
MSVCR90D.dll	263	__set_app_type
MSVCR90D.dll	415	_encode_pointer
MSVCR90D.dll	246	__p__fmode
MSVCR90D.dll	239	__p__commode
MSVCR90D.dll	306	_adjust_fdiv
MSVCR90D.dll	266	__setusermatherr
MSVCR90D.dll	365	_configthreadlocale
MSVCR90D.dll	92	_CRT_RTC_INITW
MSVCR90D.dll	390	_ctime64
MSVCR90D.dll	1394	printf
MSVCR90D.dll	1427	strcmp
MSVCR90D.dll	581	_invoke_watson

show previews

offset	size	type	comment
0	30720	EXE	07/09/2014 09:20:03	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK