OsInstaller.exe

info
MZ
PE
resources
strings
imports
foremost
hexdump
disasm
log
discuss
donate

filename	OsInstaller.exe
size	201216 (0x31200)
md5	b2a99f43f09832ef3f04cce9c3616a36

type	PE32 executable (Windows CE) ARM Thumb, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
131	20720	16
95	4091	7
93	4017	3
1	0	129
0	0	2
48	9775	23
132	20720	20
148	21022	1
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x1c2
NumberOfSections	6
TimeDateStamp	0x4c3dcced
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x26600
SizeOfInitializedData	0x4c200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x14a54
BaseOfCode	0x1000
BaseOfData	0x29000
ImageBase	0x10000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x78000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	9
DllCharacteristics	0
SizeOfStackReserve	0x10000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

HQR data file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x26274	0x26400	R-X CODE
text	0x28000	0x64	0x200	R-X CODE
.rdata	0x29000	0x209a	0x2200	R-- IDATA
.data	0x2c000	0x460f0	0x4800	RW- IDATA
.pdata	0x73000	0x1078	0x1200	R-- IDATA
.rsrc	0x75000	0x2b58	0x2c00	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x2ae4c	0x28
RESOURCE	0x75000	0x2b58
EXCEPTION	0x73000	0x1078
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x29000	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x2c000	0x208
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	744
ICON	#2	296
ICON	#3	2216
ICON	#4	1384
ICON	#5	4264
ICON	#6	1128
DIALOG	#102	268
STRING	#1	54
ACCELERATORS	#2	16
GROUP_ICON	#101	90

id	lang	string
1	1033	OsInstaller

module_name	hint	ord	function_name
COREDLL.dll		10
COREDLL.dll		2005
COREDLL.dll		11
COREDLL.dll		1047
COREDLL.dll		553
COREDLL.dll		170
COREDLL.dll		168
COREDLL.dll		492
COREDLL.dll		1094
COREDLL.dll		865
COREDLL.dll		2008
COREDLL.dll		1134
COREDLL.dll		1095
COREDLL.dll		165
COREDLL.dll		171
COREDLL.dll		173
COREDLL.dll		537
COREDLL.dll		690
COREDLL.dll		533
COREDLL.dll		532
COREDLL.dll		1397
COREDLL.dll		1611
COREDLL.dll		874
COREDLL.dll		691
COREDLL.dll		686
COREDLL.dll		56
COREDLL.dll		247
COREDLL.dll		1092
COREDLL.dll		496
COREDLL.dll		1699
COREDLL.dll		497
COREDLL.dll		493
COREDLL.dll		1044
COREDLL.dll		180
COREDLL.dll		167
COREDLL.dll		172
COREDLL.dll		557
COREDLL.dll		560
COREDLL.dll		1724
COREDLL.dll		1161
COREDLL.dll		525
COREDLL.dll		524
COREDLL.dll		545
COREDLL.dll		1486
COREDLL.dll		1487
COREDLL.dll		61
COREDLL.dll		60
COREDLL.dll		455
COREDLL.dll		463
COREDLL.dll		461
COREDLL.dll		184
COREDLL.dll	829		LocalAllocTrace
COREDLL.dll		36
COREDLL.dll		179
COREDLL.dll		175
COREDLL.dll		181
COREDLL.dll		63
COREDLL.dll		1043
COREDLL.dll		535
COREDLL.dll		1687
COREDLL.dll		1180
COREDLL.dll		1872
COREDLL.dll		1179
COREDLL.dll		464
COREDLL.dll		456
COREDLL.dll		458
COREDLL.dll		177
COREDLL.dll		169
COREDLL.dll		516
COREDLL.dll		160
COREDLL.dll		615
COREDLL.dll		1152
COREDLL.dll		1065
COREDLL.dll		20
COREDLL.dll		653
COREDLL.dll		176
COREDLL.dll		717
COREDLL.dll		336
COREDLL.dll		556
COREDLL.dll		555
COREDLL.dll		549
COREDLL.dll		548
COREDLL.dll		166
COREDLL.dll		517
COREDLL.dll		64
COREDLL.dll		87
COREDLL.dll		529
COREDLL.dll		530
COREDLL.dll		528
COREDLL.dll		1876
COREDLL.dll		34
COREDLL.dll		33
COREDLL.dll		35
COREDLL.dll		1645
COREDLL.dll		1875
COREDLL.dll		1556
COREDLL.dll		1046
COREDLL.dll		16
COREDLL.dll		15
COREDLL.dll		1492
COREDLL.dll		520
COREDLL.dll		1041
COREDLL.dll		1018
COREDLL.dll		1096
COREDLL.dll		543
COREDLL.dll		3
COREDLL.dll		4
COREDLL.dll		5
COREDLL.dll		75
COREDLL.dll		1132
COREDLL.dll		541
COREDLL.dll		2
COREDLL.dll		544
COREDLL.dll		621
COREDLL.dll		622
COREDLL.dll		550
COREDLL.dll		495
COREDLL.dll		1475
COREDLL.dll		1476
COREDLL.dll		1535
COREDLL.dll		627
COREDLL.dll		629
COREDLL.dll		628
COREDLL.dll		1539
COREDLL.dll		1489
COREDLL.dll		1068
COREDLL.dll		58
COREDLL.dll		202
COREDLL.dll		203

show previews

offset	size	type	comment
0	201216	EXE	07/14/2010 14:42:53	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK