ked.exe - Diagnostics - Одна организация

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	ked.exe
size	2601177 (0x27b0d9)
md5	f9eb6ed156220551085fc0434793e6fb

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x5225c52b
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0
SizeOfInitializedData	0x27b000
SizeOfUninitializedData	0xc27000
AddressOfEntryPoint	0xc307ef
BaseOfCode	0x1000
BaseOfData	0xc28000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0xea5000
SizeOfHeaders	0x400
CheckSum	0x283a76
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

NsPack 3.0 (North Star)

Sections

va	vsize	raw size	flags
0x1000	0xc27000	0	RWX IDATA UDATA
0xc28000	0x27b000	0x27acd9	RWX CODE IDATA
0xea3000	0x1209	0	RWX CODE IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xc30010	0x320
RESOURCE	0xc28000	0x7e18
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xc3110d	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0x7f2000	0x3a6
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0xe4939c	0xe493e8	0xb39a1c	0	0	0

show previews

type	name	size	cp
UNICODEDATA	CASE	29247	1252
UNICODEDATA	CATEGORIES	32445	1252
UNICODEDATA	COMBINING	1704	1252
UNICODEDATA	COMPOSITION	44925	1252
UNICODEDATA	DECOMPOSITION	54223	1252
UNICODEDATA	NUMBERS	5317	1252
CURSOR	#1	308	1252
CURSOR	#2	308	1252
CURSOR	#3	308	1252
CURSOR	#4	308	1252
CURSOR	#5	308	1252
CURSOR	#6	308	1252
CURSOR	#7	308	1252
CURSOR	#8	308	1252
CURSOR	#9	308	1252
CURSOR	#10	308	1252
CURSOR	#11	308	1252
CURSOR	#12	308	1252
CURSOR	#13	308	1252
CURSOR	#14	308	1252
CURSOR	#15	308	1252
CURSOR	#16	308	1252
CURSOR	#17	308	1252
CURSOR	#18	308	1252
CURSOR	#19	308	1252
CURSOR	#20	308	1252
CURSOR	#21	308	1252
CURSOR	#22	308	1252
CURSOR	#23	308	1252
BITMAP	BBABORT	464	1252
BITMAP	BBALL	484	1252
BITMAP	BBCANCEL	464	1252
BITMAP	BBCLOSE	464	1252
BITMAP	BBHELP	464	1252
BITMAP	BBIGNORE	464	1252
BITMAP	BBNO	464	1252
BITMAP	BBOK	464	1252
BITMAP	BBRETRY	464	1252
BITMAP	BBYES	464	1252
BITMAP	BTN_CLOSE	328	1252
BITMAP	BTN_MINI	328	1252
BITMAP	CDROM	192	1252
BITMAP	CLOSEDFOLDER	224	1252
BITMAP	CURRENTFOLDER	224	1252
BITMAP	DBEDIT	92	1252
BITMAP	DBEDITEH	92	1252
BITMAP	DBGARROW	92	1252
BITMAP	DBGARROWEH	92	1252
BITMAP	DBGARROWEHW	148	1252
BITMAP	DBINSERT	92	1252
BITMAP	DBINSERTEH	92	1252
BITMAP	DBMULTIARROW	92	1252
BITMAP	DBMULTIARROWEH	92	1252
BITMAP	DBMULTIDOT	92	1252
BITMAP	DBMULTIDOTEH	92	1252
BITMAP	DBN_CANCEL	312	1252
BITMAP	DBN_DELETE	312	1252
BITMAP	DBN_EDIT	312	1252
BITMAP	DBN_FIRST	312	1252
BITMAP	DBN_INSERT	312	1252
BITMAP	DBN_LAST	312	1252
BITMAP	DBN_NEXT	260	1252
BITMAP	DBN_POST	312	1252
BITMAP	DBN_PRIOR	260	1252
BITMAP	DBN_REFRESH	312	1252
BITMAP	DBSMDOWNEH	176	1252
BITMAP	DBSMDOWNEH_1	176	1252
BITMAP	DBSMUPEH	176	1252
BITMAP	DBSMUPEH_1	176	1252
BITMAP	DROPDOWNEH	176	1252
BITMAP	EXECUTABLE	224	1252
BITMAP	FLOPPY	192	1252
BITMAP	FRXBAND	192	1252
BITMAP	FRXCONNWIZARD	368	1252
BITMAP	FRXCONNWIZARD1	368	1252
BITMAP	FRXCONNWIZARD2	368	1252
BITMAP	FRXDEVICE_FNT	200	1252
BITMAP	FRXOTHER_FNT	616	1252
BITMAP	FRXSTDWIZARD	368	1252
BITMAP	FRXSTDWIZARD1	368	1252
BITMAP	FRXTRUETYPE_FNT	200	1252
BITMAP	HARD	192	1252
BITMAP	JVCALCULATORPANELBUTTONS	676	1252
BITMAP	JVCUSTOMDATEEDITGLYPH	296	1252
BITMAP	JVCUSTOMNUMEDITBUTTONGLYPH	296	1252
BITMAP	JVDBGRIDBLOB	272	1252
BITMAP	JVDBGRIDCHECKED	272	1252
BITMAP	JVDBGRIDDATA	272	1252
BITMAP	JVDBGRIDMEMO	272	1252
BITMAP	JVDBGRIDMSARROW	92	1252
BITMAP	JVDBGRIDMSDOT	92	1252
BITMAP	JVDBGRIDNOTEMPTY	272	1252
BITMAP	JVDBGRIDOBJECT	272	1252
BITMAP	JVDBGRIDOLE	272	1252
BITMAP	JVDBGRIDPICT	272	1252
BITMAP	JVDBGRIDPOPUP	84	1252
BITMAP	JVDBGRIDSMDOWN	176	1252
BITMAP	JVDBGRIDSMUP	176	1252
BITMAP	JVDBGRIDUNCHECKED	272	1252
BITMAP	JVDBSTATUSLABELSTATES	776	1252
ICON	#1	3240	1252
ICON	#2	872	1252
GROUP_ICON	MAINICON	34	1252
VERSION	#1	888	1252
MANIFEST	#1	752	1252

module_name	hint	ord	function_name
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			VirtualProtect
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			VirtualFree
KERNEL32.DLL			ExitProcess
OLEAUT32.DLL			SysFreeString
ADVAPI32.DLL			RegQueryValueExW
USER32.DLL			LoadStringW
KERNEL32.DLL			TlsSetValue
USER32.DLL			CreateWindowExW
MSIMG32.DLL			AlphaBlend
GDI32.DLL			UnrealizeObject
VERSION.DLL			VerQueryValueW
MPR.DLL			WNetOpenEnumW
KERNEL32.DLL			lstrlen
ADVAPI32.DLL			RegUnLoadKeyW
OLEAUT32.DLL			GetErrorInfo
OLE32.DLL			CreateILockBytesOnHGlobal
COMCTL32.DLL			InitializeFlatSB
KERNEL32.DLL			Sleep
OLE32.DLL			IsEqualGUID
OLEAUT32.DLL			SafeArrayPtrOfIndex
URLMON.DLL			URLDownloadToFileW
SHELL32.DLL			SHGetFileInfoW
SHELL32.DLL			SHGetSpecialFolderLocation
COMDLG32.DLL			PrintDlgW
WINSPOOL.DRV			WritePrinter
WINSPOOL.DRV			GetDefaultPrinterW
KERNEL32.DLL			MulDiv
GDI32.DLL			TranslateCharsetInfo
OLEDLG.DLL			OleUIObjectPropertiesW
WSOCK32.DLL			WSACleanup
KERNEL32.DLL			GetVersionExW
WINMM.DLL			sndPlaySoundW
KERNEL32.DLL			MulDiv
USP10.DLL			ScriptPlace
OLE32.DLL			CoUninitialize
OLE32.DLL			CoCreateInstance
SHELL32.DLL			SHGetMalloc
SHELL32.DLL			SHGetInstanceExplorer
KERNEL32.DLL			FindFirstChangeNotificationA
OLE32.DLL			DoDragDrop
OLEACC.DLL			LresultFromObject

StringTable 041904E3

CompanyName	Gelika
FileDescription	Одна организация
FileVersion	1.6.0.16
InternalName	Diagnostics
LegalCopyright
LegalTrademarks	Gelika
OriginalFilename	Diagnostics
ProductName
ProductVersion	1.6.0.0
Comments	Программа для ведения учета автотранспорных средств проходящих диагностику на СТО

VS_FIXEDFILEINFO

FileVersion	1.6.0.16
ProductVersion	1.6.0.16
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	1024	EXE	09/03/2013 11:16:59	#
15c1	15	HTM		#
15d0	2595593	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0xa60e18

[?] can't find file_offset of VA 0xa68058

[?] can't find file_offset of VA 0xa6ff18

[?] can't find file_offset of VA 0xa705c0

[?] can't find file_offset of VA 0xa7b540

[?] can't find file_offset of VA 0xa88910

[?] can't find file_offset of VA 0xa89dd8

[?] can't find file_offset of VA 0xa89f0c

[?] can't find file_offset of VA 0xa8a040

[?] can't find file_offset of VA 0xa8a174

[?] can't find file_offset of VA 0xa8a2a8

[?] can't find file_offset of VA 0xa8a3dc

[?] can't find file_offset of VA 0xa8a510

[?] can't find file_offset of VA 0xa8a644

[?] can't find file_offset of VA 0xa8a778

[?] can't find file_offset of VA 0xa8a8ac

[?] can't find file_offset of VA 0xa8a9e0

[?] can't find file_offset of VA 0xa8ab14

[?] can't find file_offset of VA 0xa8ac48

[?] can't find file_offset of VA 0xa8ad7c

[?] can't find file_offset of VA 0xa8aeb0

[?] can't find file_offset of VA 0xa8afe4

[?] can't find file_offset of VA 0xa8b118

[?] can't find file_offset of VA 0xa8b24c

[?] can't find file_offset of VA 0xa8b380

[?] can't find file_offset of VA 0xa8b4b4

[?] can't find file_offset of VA 0xa8b5e8

[?] can't find file_offset of VA 0xa8b71c

[?] can't find file_offset of VA 0xa8b850

[?] can't find file_offset of VA 0xa8b984

[?] can't find file_offset of VA 0xa8bb54

[?] can't find file_offset of VA 0xa8bd38

[?] can't find file_offset of VA 0xa8bf08

[?] can't find file_offset of VA 0xa8c0d8

[?] can't find file_offset of VA 0xa8c2a8

[?] can't find file_offset of VA 0xa8c478

[?] can't find file_offset of VA 0xa8c648

[?] can't find file_offset of VA 0xa8c818

[?] can't find file_offset of VA 0xa8c9e8

[?] can't find file_offset of VA 0xa8cbb8

[?] can't find file_offset of VA 0xa8cd00

[?] can't find file_offset of VA 0xa8ce48

[?] can't find file_offset of VA 0xa8cf08

[?] can't find file_offset of VA 0xa8cfe8

[?] can't find file_offset of VA 0xa8d0c8

[?] can't find file_offset of VA 0xa8d124

[?] can't find file_offset of VA 0xa8d180

[?] can't find file_offset of VA 0xa8d1dc

[?] can't find file_offset of VA 0xa8d238

[?] can't find file_offset of VA 0xa8d2cc

[?] can't find file_offset of VA 0xa8d328

[?] can't find file_offset of VA 0xa8d384

[?] can't find file_offset of VA 0xa8d3e0

[?] can't find file_offset of VA 0xa8d43c

[?] can't find file_offset of VA 0xa8d498

[?] can't find file_offset of VA 0xa8d4f4

[?] can't find file_offset of VA 0xa8d62c

[?] can't find file_offset of VA 0xa8d764

[?] can't find file_offset of VA 0xa8d89c

[?] can't find file_offset of VA 0xa8d9d4

[?] can't find file_offset of VA 0xa8db0c

[?] can't find file_offset of VA 0xa8dc44

[?] can't find file_offset of VA 0xa8dd48

[?] can't find file_offset of VA 0xa8de80

[?] can't find file_offset of VA 0xa8df84

[?] can't find file_offset of VA 0xa8e0bc

[?] can't find file_offset of VA 0xa8e16c

[?] can't find file_offset of VA 0xa8e21c

[?] can't find file_offset of VA 0xa8e2cc

[?] can't find file_offset of VA 0xa8e37c

[?] can't find file_offset of VA 0xa8e42c

[?] can't find file_offset of VA 0xa8e50c

[?] can't find file_offset of VA 0xa8e5cc

[?] can't find file_offset of VA 0xa8e68c

[?] can't find file_offset of VA 0xa8e7fc

[?] can't find file_offset of VA 0xa8e96c

[?] can't find file_offset of VA 0xa8eadc

[?] can't find file_offset of VA 0xa8eba4

[?] can't find file_offset of VA 0xa8ee0c

[?] can't find file_offset of VA 0xa8ef7c

[?] can't find file_offset of VA 0xa8f0ec

[?] can't find file_offset of VA 0xa8f1b4

[?] can't find file_offset of VA 0xa8f274

[?] can't find file_offset of VA 0xa8f518

[?] can't find file_offset of VA 0xa8f640

[?] can't find file_offset of VA 0xa8f768

[?] can't find file_offset of VA 0xa8f878

[?] can't find file_offset of VA 0xa8f988

[?] can't find file_offset of VA 0xa8fa98

[?] can't find file_offset of VA 0xa8fba8

[?] can't find file_offset of VA 0xa8fc04

[?] can't find file_offset of VA 0xa8fc60

[?] can't find file_offset of VA 0xa8fd70

[?] can't find file_offset of VA 0xa8fe80

[?] can't find file_offset of VA 0xa8ff90

[?] can't find file_offset of VA 0xa900a0

[?] can't find file_offset of VA 0xa900f4

[?] can't find file_offset of VA 0xa901a4

[?] can't find file_offset of VA 0xa90254

[?] can't find file_offset of VA 0xa90364

[?] can't find file_offset of VA 0xa9066c

[?] too many errors getting resource data, stopped on 0 of 1

[?] can't find file_offset of VA 0x739a1c

[?] can't find file_offset of VA 0x7f2000

ked.exe- Diagnostics - Одна организация