notepad.exe - Notepad

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	notepad.exe
size	151040 (0x24e00)
md5	daf60e13e96ecb67f0edaa89c6b01b8d

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
110	50727	1
125	50727	2
123	50727	27
1	0	217
109	50727	35
124	50727	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x47918ea2
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x9000
SizeOfInitializedData	0x1cc00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x31ed
BaseOfCode	0x1000
BaseOfData	0xd000
ImageBase	0x1000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	6.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x28000
SizeOfHeaders	0x400
CheckSum	0x286e3
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x11000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x8f40	0x9000	R-X CODE
.data	0xa000	0x2124	0x1000	RW- IDATA
.rsrc	0xd000	0x19a18	0x19c00	R-- IDATA
.reloc	0x27000	0xd18	0xe00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x8bf4	0x118
RESOURCE	0xd000	0x19a18
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x27000	0xd18
DEBUG	0x9ee0	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x4ff8	0x40
Bound_IAT	0x278	0x10c
IAT	0x1000	0x388
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
MUI	#1	232
ICON	#1	1640
ICON	#2	744
ICON	#3	488
ICON	#4	296
ICON	#5	3752
ICON	#6	2216
ICON	#7	1736
ICON	#8	1384
ICON	#9	72024
ICON	#10	9640
ICON	#11	4264
ICON	#12	2440
ICON	#13	1128
GROUP_ICON	#2	188
VERSION	#1	884
MANIFEST	#1	953

module_name	hint	ord	function_name
ADVAPI32.dll	616		RegQueryValueExW
ADVAPI32.dll	554		RegCloseKey
ADVAPI32.dll	566		RegCreateKeyW
ADVAPI32.dll	378		IsTextUnicode
ADVAPI32.dll	632		RegSetValueExW
KERNEL32.dll	465		GetFileInformationByHandle
KERNEL32.dll	300		FindNLSString
KERNEL32.dll	650		GlobalAlloc
KERNEL32.dll	668		GlobalUnlock
KERNEL32.dll	661		GlobalLock
KERNEL32.dll	125		CreateFileMappingW
KERNEL32.dll	433		GetDateFormatW
KERNEL32.dll	488		GetLocalTime
KERNEL32.dll	776		LocalUnlock
KERNEL32.dll	783		MapViewOfFile
KERNEL32.dll	799		MultiByteToWideChar
KERNEL32.dll	1099		UnmapViewOfFile
KERNEL32.dll	773		LocalReAlloc
KERNEL32.dll	339		GetACP
KERNEL32.dll	196		DeleteFileW
KERNEL32.dll	981		SetEndOfFile
KERNEL32.dll	772		LocalLock
KERNEL32.dll	329		FormatMessageW
KERNEL32.dll	1156		WideCharToMultiByte
KERNEL32.dll	1012		SetLastError
KERNEL32.dll	1175		WriteFile
KERNEL32.dll	487		GetLastError
KERNEL32.dll	775		LocalSize
KERNEL32.dll	480		GetFullPathNameW
KERNEL32.dll	798		MulDiv
KERNEL32.dll	369		GetCommandLineW
KERNEL32.dll	682		HeapSetInformation
KERNEL32.dll	427		GetCurrentProcessId
KERNEL32.dll	327		FoldStringW
KERNEL32.dll	1204		lstrcmpW
KERNEL32.dll	463		GetFileAttributesW
KERNEL32.dll	293		FindFirstFileW
KERNEL32.dll	282		FindClose
KERNEL32.dll	622		GetTimeFormatW
KERNEL32.dll	426		GetCurrentProcess
KERNEL32.dll	1079		TerminateProcess
KERNEL32.dll	595		GetSystemTimeAsFileTime
KERNEL32.dll	430		GetCurrentThreadId
KERNEL32.dll	618		GetTickCount
KERNEL32.dll	857		QueryPerformanceCounter
KERNEL32.dll	503		GetModuleHandleA
KERNEL32.dll	1055		SetUnhandledExceptionFilter
KERNEL32.dll	572		GetStartupInfoA
KERNEL32.dll	703		InterlockedCompareExchange
KERNEL32.dll	1067		Sleep
KERNEL32.dll	706		InterlockedExchange
KERNEL32.dll	1216		lstrlenW
KERNEL32.dll	491		GetLocaleInfoW
KERNEL32.dll	657		GlobalFree
KERNEL32.dll	1207		lstrcmpiW
KERNEL32.dll	986		SetErrorMode
KERNEL32.dll	128		CreateFileW
KERNEL32.dll	878		ReadFile
KERNEL32.dll	68		CloseHandle
KERNEL32.dll	766		LocalAlloc
KERNEL32.dll	705		InterlockedDecrement
KERNEL32.dll	770		LocalFree
KERNEL32.dll	709		InterlockedIncrement
KERNEL32.dll	629		GetUserDefaultUILanguage
KERNEL32.dll	1096		UnhandledExceptionFilter
GDI32.dll	606		SelectObject
GDI32.dll	635		SetMapMode
GDI32.dll	655		SetViewportExtEx
GDI32.dll	659		SetWindowExtEx
GDI32.dll	539		LPtoDP
GDI32.dll	614		SetBkMode
GDI32.dll	525		GetTextMetricsW
GDI32.dll	608		SetAbortProc
GDI32.dll	663		StartDocW
GDI32.dll	665		StartPage
GDI32.dll	221		EndPage
GDI32.dll			AbortDoc
GDI32.dll	219		EndDoc
GDI32.dll	205		DeleteDC
GDI32.dll	672		TextOutW
GDI32.dll	517		GetTextExtentPoint32W
GDI32.dll	48		CreateDCW
GDI32.dll	523		GetTextFaceW
GDI32.dll	275		EnumFontsW
GDI32.dll	500		GetStockObject
GDI32.dll	484		GetObjectW
GDI32.dll	437		GetDeviceCaps
GDI32.dll	62		CreateFontIndirectW
GDI32.dll	208		DeleteObject
USER32.dll	269		GetClientRect
USER32.dll	624		SetCursor
USER32.dll	588		ReleaseDC
USER32.dll	282		GetDC
USER32.dll	166		DialogBoxParamW
USER32.dll	614		SetActiveWindow
USER32.dll	306		GetKeyboardLayout
USER32.dll	544		PostQuitMessage
USER32.dll	150		DefWindowProcW
USER32.dll	293		GetForegroundWindow
USER32.dll	445		IsIconic
USER32.dll	160		DestroyWindow
USER32.dll	503		MessageBeep
USER32.dll	391		GetWindowPlacement
USER32.dll	58		CharUpperW
USER32.dll	565		RegisterClassExW
USER32.dll	473		LoadImageW
USER32.dll	469		LoadCursorW
USER32.dll	677		SetWindowLongW
USER32.dll	463		LoadAcceleratorsW
USER32.dll	366		GetSystemMenu
USER32.dll	678		SetWindowPlacement
USER32.dll	104		CreateWindowExW
USER32.dll	586		RegisterWindowMessageW
USER32.dll	651		SetProcessDPIAware
USER32.dll	660		SetScrollPos
USER32.dll	696		ShowWindow
USER32.dll	386		GetWindowLongW
USER32.dll	540		PeekMessageW
USER32.dll	209		EnableWindow
USER32.dll	199		DrawTextExW
USER32.dll	93		CreateDialogParamW
USER32.dll	399		GetWindowTextW
USER32.dll	517		MoveWindow
USER32.dll	426		InvalidateRect
USER32.dll	611		SendMessageW
USER32.dll	47		CharNextW
USER32.dll	61		CheckMenuItem
USER32.dll	71		CloseClipboard
USER32.dll	438		IsClipboardFormatAvailable
USER32.dll	527		OpenClipboard
USER32.dll	327		GetMenuState
USER32.dll	207		EnableMenuItem
USER32.dll	363		GetSubMenu
USER32.dll	316		GetMenu
USER32.dll	674		SetWinEventHook
USER32.dll	334		GetMessageW
USER32.dll	543		PostMessageW
USER32.dll	511		MessageBoxW
USER32.dll	292		GetFocus
USER32.dll	768		WinHelpW
USER32.dll	286		GetDlgCtrlID
USER32.dll	211		EndDialog
USER32.dll	398		GetWindowTextLengthW
USER32.dll	471		LoadIconW
USER32.dll	441		IsDialogMessageW
USER32.dll	723		TranslateAcceleratorW
USER32.dll	725		TranslateMessage
USER32.dll	169		DispatchMessageW
USER32.dll	745		UpdateWindow
USER32.dll	727		UnhookWinEvent
USER32.dll	65		ChildWindowFromPoint
USER32.dll	290		GetDlgItemTextW
USER32.dll	631		SetDlgItemTextW
USER32.dll	633		SetFocus
USER32.dll	684		SetWindowTextW
USER32.dll	341		GetParent
USER32.dll	484		LoadStringW
USER32.dll	602		SendDlgItemMessageW
USER32.dll	281		GetCursorPos
USER32.dll	596		ScreenToClient
msvcrt.dll	55		void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	295		_controlfp
msvcrt.dll	974		_vsnwprintf
msvcrt.dll	1262		memset
msvcrt.dll	1133		_wtol
msvcrt.dll	1258		memcpy
msvcrt.dll	1228		iswctype
msvcrt.dll	1242		localtime
msvcrt.dll	345		_except_handler4_common
msvcrt.dll	210		__set_app_type
msvcrt.dll	190		__p__fmode
msvcrt.dll	185		__p__commode
msvcrt.dll	245		_adjust_fdiv
msvcrt.dll	257		_amsg_exit
msvcrt.dll	469		_initterm
msvcrt.dll	231		_acmdln
msvcrt.dll	1167		exit
msvcrt.dll	1332		time
msvcrt.dll	145		__getmainargs
msvcrt.dll	500		_ismbblead
msvcrt.dll	106		_XcptFilter
msvcrt.dll	354		_exit
msvcrt.dll	276		_cexit
msvcrt.dll	212		__setusermatherr
COMDLG32.dll	14		GetSaveFileNameW
COMDLG32.dll	8		FindTextW
COMDLG32.dll	23		ReplaceTextW
COMDLG32.dll	17		PageSetupDlgW
COMDLG32.dll	20		PrintDlgExW
COMDLG32.dll	12		GetOpenFileNameW
COMDLG32.dll	4		CommDlgExtendedError
COMDLG32.dll	3		ChooseFontW
COMDLG32.dll	10		GetFileTitleW
SHELL32.dll	27		DragAcceptFiles
SHELL32.dll	32		DragQueryFileW
SHELL32.dll	28		DragFinish
SHELL32.dll	141		SHCreateItemFromParsingName
SHELL32.dll	272		ShellAboutW
WINSPOOL.DRV	133		GetPrinterDriverW
WINSPOOL.DRV	29		ClosePrinter
WINSPOOL.DRV	143		OpenPrinterW
ole32.dll	102		CoTaskMemAlloc
ole32.dll	16		CoCreateInstance
ole32.dll	103		CoTaskMemFree
ole32.dll	107		CoUninitialize
ole32.dll	62		CoInitializeEx
SHLWAPI.dll	93		PathIsFileSpecW
SHLWAPI.dll	253		SHStrDupW
COMCTL32.dll	12		CreateStatusWindowW
COMCTL32.dll		345
OLEAUT32.dll		2
OLEAUT32.dll		6
ntdll.dll	1286		WinSqmAddToStream

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Notepad
FileVersion	6.0.6001.18000 (longhorn_rtm.080118-1840)
InternalName	Notepad
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	NOTEPAD.EXE
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.0.6001.18000

VS_FIXEDFILEINFO

FileVersion	6.0.6001.18000
ProductVersion	6.0.6001.18000
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	151040	EXE	01/19/2008 05:46:10	#
15c1	15	HTM		#
db60	72024	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x278

notepad.exe-

MZ Header

Rich Header

DOS stub

PE Header

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

notepad.exe
-