filenameGoldenEye.exe
size73216 (0x11e00)
md5b498d913e12d14eabaa873d7aca2b1e6
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x50
blocks_in_file2
num_relocs0
header_paragraphs4
min_extra_paragraphs0xf
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0x1a
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections8
TimeDateStamp0x2a425e19
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x818e
Magic0x10b
LinkerVersion2.25
SizeOfCode0x7000
SizeOfInitializedData0xaa00
SizeOfUninitializedData0
AddressOfEntryPoint0x7d20
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x3f000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x4000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Borland Delphi v3.0

Sections

namevavsizeraw sizeflags
CODE0x10000x6f840x7000R-X CODE
DATA0x80000x83fc0x8400RW- IDATA
BSS0x110000x287a90RW-
.idata0x3a0000x6460x800RW- IDATA
.tls0x3b00080RW-
.rdata0x3c0000x180x200R-- IDATA SHARED
.reloc0x3d0000xb900xc00R-- IDATA SHARED
.rsrc0x3e0000x10000x1000R-- IDATA SHARED

Data Directory

typevasize
EXPORT00
IMPORT0x3a0000x646
RESOURCE0x3e0000x1000
EXCEPTION00
SECURITY00
BASERELOC0x3d0000xb90
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x3c0000x18
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x43b0000x43b0080x40808c0x43c01000
typenamesizecp
STRING#40922400
STRING#40932160
STRING#40946080
STRING#40958920
STRING#40966720
RCDATADVCLAL160
RCDATAPACKAGEINFO960
MANIFEST#14370
idlangstring
654560November
654570December
654580Sun
654590Mon
654600Tue
654610Wed
654620Thu
654630Fri
654640Sat
654650Sunday
654660Monday
654670Tuesday
654680Wednesday
654690Thursday
654700Friday
654710Saturday
654720Jul
654730Aug
654740Sep
654750Oct
654760Nov
654770Dec
654780January
654790February
654800March
654810April
654820May
654830June
654840July
654850August
654860September
654870October
654880Invalid variant type conversion
654890Invalid variant operation
654900Invalid argument
654910External exception %x
654920Assertion failed
654930Interface not supported
654940Exception in safecall method
654950%s (%s, line %d)
654960Abstract Error
654970Access violation at address %p in module '%s'. %s of address %p
654980Jan
654990Feb
655000Mar
655010Apr
655020May
655030Jun
655040Invalid pointer operation
655050Invalid class typecast
655060Access violation at address %p. %s of address %p
655070Access violation
655080Stack overflow
655090Control-C hit
655100Privileged instruction
655110Exception %s in module %s at %p. %s%s
655120Application Error
655130Format '%s' invalid or incompatible with argument
655140No argument for format '%s'
655150Variant method calls not supported
655160Read
655170Write
655180Error creating variant or safe array
655190Variant or safe array index out of bounds
655200Out of memory
655210I/O error %d
655220File not found
655230Invalid filename
655240Too many open files
655250File access denied
655260Read beyond end of file
655270Disk full
655280Invalid numeric input
655290Division by zero
655300Range check error
655310Integer overflow
655320Invalid floating point operation
655330Floating point division by zero
655340Floating point overflow
655350Floating point underflow
module_namehintordfunction_name
kernel32.dllDeleteCriticalSection
kernel32.dllLeaveCriticalSection
kernel32.dllEnterCriticalSection
kernel32.dllInitializeCriticalSection
kernel32.dllVirtualFree
kernel32.dllVirtualAlloc
kernel32.dllLocalFree
kernel32.dllLocalAlloc
kernel32.dllGetVersion
kernel32.dllGetCurrentThreadId
kernel32.dllWideCharToMultiByte
kernel32.dlllstrlenA
kernel32.dlllstrcpynA
kernel32.dllLoadLibraryExA
kernel32.dllGetThreadLocale
kernel32.dllGetStartupInfoA
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleA
kernel32.dllGetModuleFileNameA
kernel32.dllGetLocaleInfoA
kernel32.dllGetCommandLineA
kernel32.dllFreeLibrary
kernel32.dllFindFirstFileA
kernel32.dllFindClose
kernel32.dllExitProcess
kernel32.dllWriteFile
kernel32.dllUnhandledExceptionFilter
kernel32.dllRtlUnwind
kernel32.dllRaiseException
kernel32.dllGetStdHandle
user32.dllGetKeyboardType
user32.dllLoadStringA
user32.dllMessageBoxA
user32.dllCharNextA
advapi32.dllRegQueryValueExA
advapi32.dllRegOpenKeyExA
advapi32.dllRegCloseKey
oleaut32.dllSysFreeString
kernel32.dllTlsSetValue
kernel32.dllTlsGetValue
kernel32.dllLocalAlloc
kernel32.dllGetModuleHandleA
kernel32.dllWriteFile
kernel32.dllWinExec
kernel32.dllVirtualQuery
kernel32.dllGetVersionExA
kernel32.dllGetThreadLocale
kernel32.dllGetStringTypeExA
kernel32.dllGetStdHandle
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleA
kernel32.dllGetModuleFileNameA
kernel32.dllGetLocaleInfoA
kernel32.dllGetDiskFreeSpaceA
kernel32.dllGetCPInfo
kernel32.dllGetACP
kernel32.dllEnumCalendarInfoA
kernel32.dllCreateFileA
kernel32.dllCloseHandle
user32.dllMessageBoxA
user32.dllLoadStringA
user32.dllGetSystemMetrics
user32.dllCharNextA
user32.dllCharToOemA
offsetsizetypecomment
073216EXE06/19/1992 22:22:17#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK