filenameNarrator.exe
size94720 (0x17200)
md5bfb758841fc3ebbb98d9aff1f530487f
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
207655011
205655012
2066550120
2036550111
1050
211655012
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x54504677
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x1000
SizeOfInitializedData0x16000
SizeOfUninitializedData0
AddressOfEntryPoint0x1940
BaseOfCode0x1000
BaseOfData0x2000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion6.3
Reserved10
SizeOfImage0x1b000
SizeOfHeaders0x400
CheckSum0x1fa03
Subsystem2
DllCharacteristics0xc140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xf940x1000R-X CODE
.data0x20000x3740x200RW- IDATA
.idata0x30000x54e0x600R-- IDATA
.rsrc0x40000x153180x15400R-- IDATA
.reloc0x1a0000x1740x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x30d00x78
RESOURCE0x40000x15318
EXCEPTION00
SECURITY00
BASERELOC0x1a0000x174
DEBUG0x10500x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x10c80x5c
Bound_IAT00
IAT0x30000xcc
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#12960
ICON#213840
ICON#34880
ICON#417360
ICON#57440
ICON#622160
ICON#716400
ICON#837520
ICON#911280
ICON#1024400
ICON#1142640
ICON#1296400
ICON#13537950
GROUP_ICON#11880
VERSION#18840
MANIFEST#113180
module_namehintordfunction_name
KERNEL32.dll247DeactivateActCtx
KERNEL32.dll1162ReleaseActCtx
KERNEL32.dll509GetCurrentActCtx
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll168CreateActCtxW
KERNEL32.dll2ActivateActCtx
KERNEL32.dll592GetLastError
KERNEL32.dll1088RaiseException
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll754GetTickCount
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll1362Sleep
KERNEL32.dll1377TerminateProcess
msvcrt.dll208__p__fmode
msvcrt.dll364_except_handler4_common
msvcrt.dll313_controlfp
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll1292memcpy_s
msvcrt.dll1031_wcmdln
msvcrt.dll490_initterm
msvcrt.dll230__setusermatherr
msvcrt.dll294_cexit
msvcrt.dll373_exit
msvcrt.dll1200exit
msvcrt.dll228__set_app_type
msvcrt.dll243__wgetmainargs
msvcrt.dll275_amsg_exit
msvcrt.dll203__p__commode
msvcrt.dll113_XcptFilter
OLEAUT32.dll7
OLEAUT32.dll4
OLEAUT32.dll6
ole32.dll80CoInitializeEx
ole32.dll127CoUninitialize
ole32.dll26CoCreateInstance
SHLWAPI.dll143PathRemoveFileSpecW
SHLWAPI.dll73PathFileExistsW

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionScreen Reader
FileVersion6.3.9600.17415 (winblue_r4.141028-1500)
InternalNameSR.exe
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameSR.exe
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.3.9600.17415

VS_FIXEDFILEINFO

FileVersion6.3.9600.17415
ProductVersion6.3.9600.17415
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
094720EXE10/29/2014 01:44:23#
15c115HTM#
98b853795PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER