at3tool.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	at3tool.exe
size	790528 (0xc1000)
md5	e6c49df45efe619ee3ace5796dd41aac

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
93	3077	3
96	3077	1
15	3077	6
93	4035	2
1	0	46
10	8966	2
48	9044	5
95	3077	19
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x45d53f82
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0x50000
SizeOfInitializedData	0x78000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x50635
BaseOfCode	0x1000
BaseOfData	0x51000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xc9000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.1 EXE / v7.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4fa46	0x50000	R-X CODE
.rdata	0x51000	0x6ba7e	0x6c000	R-- IDATA
.data	0xbd000	0xbc7c	0x4000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xbc70c	0x3c
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x510c0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x51000	0xc0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
MSVCR71.dll	688	fseek
MSVCR71.dll	692	fwrite
MSVCR71.dll	684	free
MSVCR71.dll	735	malloc
MSVCR71.dll	678	fprintf
MSVCR71.dll	323	_iob
MSVCR71.dll	742	memmove
MSVCR71.dll	284	_ftol
MSVCR71.dll	675	floor
MSVCR71.dll	61	_CIpow
MSVCR71.dll	741	memcpy
MSVCR71.dll	654	calloc
MSVCR71.dll	52	_CIasin
MSVCR71.dll	155	__security_error_handler
MSVCR71.dll	241	_except_handler3
MSVCR71.dll	690	ftell
MSVCR71.dll	250	_exit
MSVCR71.dll	75	_XcptFilter
MSVCR71.dll	205	_cexit
MSVCR71.dll	124	__p___initenv
MSVCR71.dll	194	_amsg_exit
MSVCR71.dll	110	__getmainargs
MSVCR71.dll	319	_initterm
MSVCR71.dll	159	__setusermatherr
MSVCR71.dll	187	_adjust_fdiv
MSVCR71.dll	130	__p__commode
MSVCR71.dll	135	__p__fmode
MSVCR71.dll	156	__set_app_type
MSVCR71.dll	107	__dllonexit
MSVCR71.dll	440	_onexit
MSVCR71.dll	219	_controlfp
MSVCR71.dll	683	fread
MSVCR71.dll	670	fgetc
MSVCR71.dll	677	fopen
MSVCR71.dll	666	fclose
MSVCR71.dll	663	exit
MSVCR71.dll	651	atoi
MSVCR71.dll	202	_c_exit
MSVCR71.dll	748	printf
KERNEL32.dll	323	GetCurrentProcessId
KERNEL32.dll	326	GetCurrentThreadId
KERNEL32.dll	479	GetTickCount
KERNEL32.dll	675	QueryPerformanceCounter
KERNEL32.dll	383	GetModuleHandleA
KERNEL32.dll	185	ExitProcess
KERNEL32.dll	458	GetSystemTimeAsFileTime

show previews

offset	size	type	comment
0	790528	EXE	02/16/2007 05:22:10	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK