user32.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	user32.exe
size	68582 (0x10be6)
md5	e09d73fcb3dbc428e9ba91a99358082c

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xe
TimeDateStamp	0x56bded3f
PointerToSymbolTable	0xaa00
NumberOfSymbols	0x479
SizeOfOptionalHeader	0xe0
Characteristics	0x107
Magic	0x10b
LinkerVersion	2.56
SizeOfCode	0x6e00
SizeOfInitializedData	0x1a00
SizeOfUninitializedData	0x7400
AddressOfEntryPoint	0x1110
BaseOfCode	0x1000
BaseOfData	0x8000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x1c000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Dev-C++ v5

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6dd8	0x6e00	R-X CODE
.data	0x8000	0x20	0x200	RW- IDATA
.rdata	0x9000	0xca0	0xe00	R-- IDATA
.bss	0xa000	0x73c8	0	RW- UDATA
.idata	0x12000	0x954	0xa00	RW- IDATA
/4	0x13000	0x20	0x200	R-- DISCARDABLE
/19	0x14000	0x66	0x200	R-- DISCARDABLE
/35	0x15000	0x9b6	0xa00	R-- DISCARDABLE
/47	0x16000	0x22c	0x400	R-- DISCARDABLE
/61	0x17000	0x1ea	0x200	R-- DISCARDABLE
/73	0x18000	0xdc	0x200	R-- DISCARDABLE
/86	0x19000	0x10	0x200	R-- DISCARDABLE
/97	0x1a000	0x224	0x400	R-- DISCARDABLE
/108	0x1b000	0x18	0x200	R-- DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x12000	0x954
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
KERNEL32.DLL			CloseHandle
KERNEL32.DLL			CopyFileA
KERNEL32.DLL			CreateFileA
KERNEL32.DLL			CreateProcessA
KERNEL32.DLL			CreateThread
KERNEL32.DLL			ExitProcess
KERNEL32.DLL			FreeLibrary
KERNEL32.DLL			GetCommandLineA
KERNEL32.DLL			GetExitCodeProcess
KERNEL32.DLL			GetExitCodeThread
KERNEL32.DLL			GetModuleFileNameA
KERNEL32.DLL			GetModuleHandleA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			GetStartupInfoA
KERNEL32.DLL			GetSystemDirectoryA
KERNEL32.DLL			GetTickCount
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			SetUnhandledExceptionFilter
KERNEL32.DLL			Sleep
KERNEL32.DLL			TerminateThread
KERNEL32.DLL			WaitForSingleObject
KERNEL32.DLL			WriteFile
ADVAPI32.DLL			RegCloseKey
ADVAPI32.DLL			RegCreateKeyExA
ADVAPI32.DLL			RegDeleteValueA
ADVAPI32.DLL			RegSetValueExA
msvcrt.dll			__getmainargs
msvcrt.dll			__p__environ
msvcrt.dll			__p__fmode
msvcrt.dll			__set_app_type
msvcrt.dll			_cexit
msvcrt.dll			_iob
msvcrt.dll			_onexit
msvcrt.dll			_setmode
msvcrt.dll			asctime
msvcrt.dll			atexit
msvcrt.dll			atoi
msvcrt.dll			clock
msvcrt.dll			exit
msvcrt.dll			free
msvcrt.dll			localtime
msvcrt.dll			malloc
msvcrt.dll			memcpy
msvcrt.dll			memset
msvcrt.dll			rand
msvcrt.dll			signal
msvcrt.dll			sprintf
msvcrt.dll			srand
msvcrt.dll			strcat
msvcrt.dll			strchr
msvcrt.dll			strcmp
msvcrt.dll			strcpy
msvcrt.dll			strlen
msvcrt.dll			strncat
msvcrt.dll			strncmp
msvcrt.dll			strstr
msvcrt.dll			strtok
msvcrt.dll			time
SHELL32.DLL			ShellExecuteA
WININET.DLL			InternetCloseHandle
WININET.DLL			InternetGetConnectedState
WININET.DLL			InternetOpenA
WININET.DLL			InternetOpenUrlA
WININET.DLL			InternetReadFile
WS2_32.DLL			WSAAsyncSelect
WS2_32.DLL			WSACleanup
WS2_32.DLL			WSAStartup
WS2_32.DLL			accept
WS2_32.DLL			bind
WS2_32.DLL			closesocket
WS2_32.DLL			connect
WS2_32.DLL			gethostbyaddr
WS2_32.DLL			gethostbyname
WS2_32.DLL			htons
WS2_32.DLL			inet_addr
WS2_32.DLL			listen
WS2_32.DLL			ntohs
WS2_32.DLL			recv
WS2_32.DLL			send
WS2_32.DLL			sendto
WS2_32.DLL			socket

show previews

offset	size	type	comment
0	43520	EXE	02/12/2016 14:33:35	#
15c1	15	HTM		#
aa00	25062	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK