0x001E3200.exe

info
MZ
PE
imports
exports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	0x001E3200.exe
size	78848 (0x13400)
md5	bf890ac3d7600e6faad0e613e26ed634

type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
96	3077	3
93	2067	2
28	9178	1
93	2179	9
1	0	160
100	6030	47
92	6030	1
90	6030	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4fbcba65
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x210e
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0xa400
SizeOfInitializedData	0x6000
SizeOfUninitializedData	0
AddressOfEntryPoint	0xad71
BaseOfCode	0x1000
BaseOfData	0xc000
ImageBase	0x10000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x13000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x400
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xa2df	0xa400	R-X CODE
.rdata	0xc000	0x4e64	0x5000	R-- IDATA
.data	0x11000	0x341	0x400	RW- IDATA
.reloc	0x12000	0xb36	0xc00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x107d0	0x694
IMPORT	0x10098	0x78
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x12000	0x994
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xc000	0x1d8
Delay_IAT	0xfb48	0xe0
CLR_Header	0	0

module_name	hint	ord	function_name
msi.dll		114
msi.dll		120
msi.dll		46
msi.dll		26
msi.dll		48
msi.dll		34
msi.dll		145
msi.dll		118
msi.dll		103
msi.dll		67
msi.dll		124
msi.dll		73
msi.dll		171
msi.dll		74
msi.dll		163
msi.dll		160
msi.dll		159
msi.dll		121
msi.dll		125
msi.dll		17
msi.dll		8
msi.dll		70
msi.dll		147
msi.dll		47
msi.dll		144
msi.dll		31
msi.dll		158
msi.dll		20
msi.dll		117
msi.dll		58
msi.dll		204
msi.dll		112
msi.dll		189
msi.dll		116
msi.dll		139
msi.dll		170
msi.dll		32
msi.dll		49
KERNEL32.dll	125		DeleteFileW
KERNEL32.dll	543		InterlockedExchange
KERNEL32.dll	771		SetEndOfFile
KERNEL32.dll	847		TerminateProcess
KERNEL32.dll	634		OpenProcess
KERNEL32.dll	947		lstrcmpiA
KERNEL32.dll	239		FreeLibrary
KERNEL32.dll	524		HeapFree
KERNEL32.dll	411		GetProcessHeap
KERNEL32.dll	518		HeapAlloc
KERNEL32.dll	795		SetLastError
KERNEL32.dll	945		lstrcmpW
KERNEL32.dll	632		OpenMutexA
KERNEL32.dll	839		Sleep
KERNEL32.dll	328		GetDiskFreeSpaceW
KERNEL32.dll	942		lstrcatW
KERNEL32.dll	197		FindClose
KERNEL32.dll	948		lstrcmpiW
KERNEL32.dll	211		FindNextFileA
KERNEL32.dll	212		FindNextFileW
KERNEL32.dll	201		FindFirstFileA
KERNEL32.dll	204		FindFirstFileW
KERNEL32.dll	696		RemoveDirectoryA
KERNEL32.dll	941		lstrcatA
KERNEL32.dll	950		lstrcpyA
KERNEL32.dll	953		lstrcpynA
KERNEL32.dll	364		GetLocaleInfoA
KERNEL32.dll	361		GetLastError
KERNEL32.dll	865		UnlockFile
KERNEL32.dll	916		WriteFile
KERNEL32.dll	601		LockFile
KERNEL32.dll	782		SetFilePointer
KERNEL32.dll	681		ReadFile
KERNEL32.dll	338		GetExitCodeProcess
KERNEL32.dll	46		CloseHandle
KERNEL32.dll	899		WaitForSingleObject
KERNEL32.dll	124		DeleteFileA
KERNEL32.dll	667		RaiseException
KERNEL32.dll	96		CreateProcessA
KERNEL32.dll	590		LocalAlloc
KERNEL32.dll	594		LocalFree
KERNEL32.dll	903		WideCharToMultiByte
KERNEL32.dll	956		lstrlenA
KERNEL32.dll	479		GetVersionExA
KERNEL32.dll	584		LoadLibraryA
KERNEL32.dll	408		GetProcAddress
KERNEL32.dll	944		lstrcmpA
KERNEL32.dll	460		GetTempPathW
KERNEL32.dll	458		GetTempFileNameW
KERNEL32.dll	80		CreateFileW
KERNEL32.dll	459		GetTempPathA
KERNEL32.dll	457		GetTempFileNameA
KERNEL32.dll	77		CreateFileA
KERNEL32.dll	140		DuplicateHandle
KERNEL32.dll	314		GetCurrentProcess
KERNEL32.dll	433		GetStdHandle
KERNEL32.dll	99		CreateProcessW
USER32.dll	379		GetWindowThreadProcessId
USER32.dll	513		PostMessageA
USER32.dll	429		IsWindow
USER32.dll	378		GetWindowTextW
USER32.dll	222		EnumWindows
USER32.dll	366		GetWindowLongA
USER32.dll	727		wsprintfW
USER32.dll	726		wsprintfA
USER32.dll	279		GetForegroundWindow
USER32.dll	485		MessageBoxW
USER32.dll	203		EnumChildWindows
USER32.dll	571		SendMessageA
USER32.dll	252		GetClassNameA
comdlg32.dll	9		GetOpenFileNameA
ole32.dll	16		CoCreateInstance
ole32.dll	58		CoInitialize
ole32.dll	100		CoTaskMemFree
ole32.dll	104		CoUninitialize

ord	entry_va	function_name
1	0x33be	AI_AuthorSinglePackage
2	0x842c	AI_ResolveKnownFolders
3	0x68cd	AI_SearchOfficeAddins
4	0x5381	ActiveInternetConnection
5	0x53c0	AddCaspolSecurityPolicy
6	0x6bd9	BrowseForFile
7	0x5f22	CheckFreeTCPPort
8	0x8f11	CheckIfUserExists
9	0xa7b9	ChooseTextStyles
10	0x987a	CloseApplication
11	0x4295	ComputeReplaceProductsList
12	0x9a7a	CreateExeProcess
13	0x4dfa	DeleteEmptyDirectory
14	0x725c	DeleteFromComboBox
15	0x7297	DeleteFromListBox
16	0x4cf6	DeleteShortcuts
17	0x9c6c	DetectProcess
18	0x9c90	DetectService
19	0x9d50	EnumStartedServices
20	0x72d2	ExtractComboBoxData
21	0x730d	ExtractListBoxData
22	0x5c37	GetArpIconPath
23	0x5e12	GetFreeTCPPort
24	0x904e	GetLocalizedCredentials
25	0x6016	GetPathFreeSpace
26	0x8a85	GetVideoMemory
27	0x45ec	IsRunningOnVM
28	0xa466	JoinFiles
29	0x3232	LaunchApp
30	0x3242	LaunchLogFile
31	0x4e7b	LoadShortcutDirs
32	0xa130	LogOnAsAService
33	0x61fe	MsgBox
34	0x3087	MsmTrialMessage
35	0x8692	PlayAudioFile
36	0x71e6	PopulateComboBox
37	0x7221	PopulateListBox
38	0x44cf	PrepareUpgrade
39	0x8471	PreserveInstallType
40	0xa5c6	PreventInstancesUpgrade
41	0x50af	PrintRTF
42	0x55a6	RemoveCaspolSecurityPolicy
43	0x70dd	RequiredJdkExists
44	0x6fd4	RequiredJreExists
45	0x8419	ResolveKnownFolder
46	0xa0cb	ResolveServiceProperties
47	0x3d2a	RestoreLocation
48	0x7fcc	RunAllExitActions
49	0x332a	RunAsAdmin
50	0x7ec9	RunFinishActions
51	0x69bf	SetLatestVersionPath
52	0x9c7e	StopProcess
53	0x3072	TrialMessage
54	0x8522	UninstallPreviousVersions
55	0xabf8	UpdateFeatureStates
56	0x81a8	UpdateInstallMode
57	0x8192	UpdateMsiEditControls
58	0x3222	ViewReadMe
59	0x6160	WarningMessageBox

module_name	aicustact.dll
flags	0
timestamp	2012-05-23 10:22:29
version	0.0
ordinal_base	1
nFunctions	59
nNames	59
Names(59)	0x108e4
Functions(59)	0x107f8
NameOrdinals(59)	0x109d0

show previews

offset	size	type	comment
0	67584	DLL	05/23/2012 10:22:29	#
15c1	15	HTM		#
11e00	5632	DLL	05/23/2012 10:27:41	#

Scanning the drive for archives:
1 file, 78848 bytes (77 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK