calc.asp212.exe - CALC.EXE - Windows Calculator

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	calc.asp212.exe
size	355840 (0x56e00)
md5	f73afcb96d9ca73be3312601297d9c61

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
149	21022	9
1	0	367
147	21022	29
132	21022	129
131	21022	25
148	21022	1
145	21022	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x48ccbd34
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x4aa00
SizeOfInitializedData	0x53200
SizeOfUninitializedData	0
AddressOfEntryPoint	0xa1001
BaseOfCode	0x1000
BaseOfData	0x4c000
ImageBase	0x1000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	5.256
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0xce000
SizeOfHeaders	0x400
CheckSum	0xa897b
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x2000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.12

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x4b000	0x1c000	RW- IDATA
.data	0x4c000	0x5000	0x800	RW- IDATA
.rsrc	0x51000	0x4b000	0xb800	RW- IDATA
.reloc	0x9c000	0x5000	0x2c00	RW- IDATA
.aspack	0xa1000	0x2c000	0x2be00	RW- IDATA
.adata	0xcd000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xa1fac	0x2cc
RESOURCE	0x51000	0x4ab07
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xa1f54	8
DEBUG	0x1610	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

show previews

type	name	size
IMAGE	#157	7465
IMAGE	#165	4086
IMAGE	#170	4234
IMAGE	#175	4625
IMAGE	#180	4873
IMAGE	#204	3048
IMAGE	#208	3052
IMAGE	#212	3217
IMAGE	#216	3338
IMAGE	#217	4191
IMAGE	#218	4229
IMAGE	#219	4110
IMAGE	#220	4065
IMAGE	#961	3235
IMAGE	#981	470
IMAGE	#982	587
IMAGE	#983	518
IMAGE	#3000	5344
IMAGE	#3015	4154
IMAGE	#3045	4815
IMAGE	#3051	6038
IMAGE	#3060	4290
IMAGE	#3075	4815
IMAGE	#3091	4550
IMAGE	#3100	1545
IMAGE	#3102	1518
IMAGE	#3103	853
IMAGE	#3104	593
IMAGE	#3106	3398
IMAGE	#3107	3605
IMAGE	#3108	3508
IMAGE	#3109	3761
MUI	#1	280
WEVT_TEMPLATE	#1	4750
BITMAP	IDT_BTN_STR_STATISTICS	1064
BITMAP	#965	1064
BITMAP	#975	1064
BITMAP	#977	1064
BITMAP	#979	1064
BITMAP	#980	1064
BITMAP	#985	1064
BITMAP	#3105	2740
ICON	#1	744
ICON	#2	296
ICON	#3	1640
ICON	#4	744
ICON	#5	296
ICON	#6	3752
ICON	#7	2216
ICON	#8	1384
ICON	#9	60175
ICON	#10	9640
ICON	#11	4264
ICON	#12	1128
ICON	#13	1640
ICON	#14	744
ICON	#15	296
ICON	#16	3752
ICON	#17	2216
ICON	#18	1384
ICON	#19	60175
ICON	#20	9640
ICON	#21	4264
ICON	#22	1128
ICON	#23	872
GROUP_ICON	SC	146
GROUP_ICON	#232	34
GROUP_ICON	#233	20
GROUP_ICON	#234	146
VERSION	#1	888
MANIFEST	#1	1167

module_name	ord	function_name
kernel32.dll		GetProcAddress
kernel32.dll		GetModuleHandleA
kernel32.dll		LoadLibraryA
shlwapi.dll	225
gdiplus.dll		GdipCreateBitmapFromScan0
advapi32.dll		RegDeleteKeyW
oleaut32.dll	150
ole32.dll		CoCreateInstance
comctl32.dll	392
ntdll.dll		WinSqmAddToStream
user32.dll		OpenClipboard
rpcrt4.dll		UuidCreate
winmm.dll		timeGetTime
gdi32.dll		CreateCompatibleBitmap
msvcrt.dll		_strtoi64
shell32.dll	165

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Calculator
FileVersion	6.1.6801.0 (winmain_win7m3.080913-2030)
InternalName	CALC
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	CALC.EXE
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.6801.0

VS_FIXEDFILEINFO

FileVersion	6.1.6801.0
ProductVersion	6.1.6801.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	355840	EXE	09/14/2008 07:28:52	#
15c1	15	HTM		#
30a00	60175	PNG	(256 x 256)	#
456f8	60175	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x5d3b0

[?] can't find file_offset of VA 0x5e3c0

[?] can't find file_offset of VA 0x5f3a4

[?] can't find file_offset of VA 0x60048

[?] can't find file_offset of VA 0x60220

[?] can't find file_offset of VA 0x6046c

[?] can't find file_offset of VA 0x60674

[?] can't find file_offset of VA 0x61b54

[?] can't find file_offset of VA 0x62b90

[?] can't find file_offset of VA 0x63e60

[?] can't find file_offset of VA 0x655f8

[?] can't find file_offset of VA 0x666bc

[?] can't find file_offset of VA 0x6798c

[?] can't find file_offset of VA 0x68b54

[?] can't find file_offset of VA 0x69160

[?] can't find file_offset of VA 0x69750

[?] can't find file_offset of VA 0x69aa8

[?] can't find file_offset of VA 0x69cfc

[?] can't find file_offset of VA 0x6aa44

[?] can't find file_offset of VA 0x6b85c

[?] can't find file_offset of VA 0x6c610

[?] can't find file_offset of VA 0x6d4c4

[?] can't find file_offset of VA 0x6d5dc

[?] can't find file_offset of VA 0x6e86c

[?] can't find file_offset of VA 0x6ec94

[?] can't find file_offset of VA 0x6f0bc

[?] can't find file_offset of VA 0x6f4e4

[?] can't find file_offset of VA 0x6f90c

[?] can't find file_offset of VA 0x6fd34

[?] can't find file_offset of VA 0x7015c

[?] can't find file_offset of VA 0x70584

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x0

calc.asp212.exe- CALC.EXE - Windows Calculator