yasca.exe

info
MZ
PE
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	yasca.exe
size	30752 (0x7820)
md5	ee8f5fec2efb91b2d74b6c0e4aaab169

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4804f131
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10e
Magic	0x10b
LinkerVersion	2.55
SizeOfCode	0x6200
SizeOfInitializedData	0x1200
SizeOfUninitializedData	0x400
AddressOfEntryPoint	0x1219
BaseOfCode	0x1000
BaseOfData	0x8000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xb000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ (3.0 old crap)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6178	0x6178	R-X CODE
.bss	0x8000	0x240	0	RW- UDATA
.data	0x9000	0xc74	0xc74	RW- IDATA
.idata	0xa000	0x2b0	0x2b0	RW- CODE IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa000	0x2b0
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
KERNEL32.dll	632	RtlUnwind
CRTDLL.DLL	200	_iob
CRTDLL.DLL	232	_itoa
CRTDLL.DLL	24	__GetMainArgs
CRTDLL.DLL	431	_strnicmp
CRTDLL.DLL	522	exit
CRTDLL.DLL	537	fputc
CRTDLL.DLL	585	localeconv
CRTDLL.DLL	596	memcpy
CRTDLL.DLL	597	memmove
CRTDLL.DLL	598	memset
CRTDLL.DLL	602	pow
CRTDLL.DLL	608	raise
CRTDLL.DLL	618	signal
CRTDLL.DLL	625	strcat
CRTDLL.DLL	626	strchr
CRTDLL.DLL	635	strncmp
CRTDLL.DLL	643	strtol
CRTDLL.DLL	648	system
CRTDLL.DLL	673	wcslen
CRTDLL.DLL	687	wctomb

show previews

offset	size	type	comment
0	30384	EXE	04/15/2008 18:17:21	#
15c1	15	HTM		#
76b0	368	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 30752 bytes (31 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK