filenamecalc.exe
size114688 (0x1c000)
md5fa1d0ddc1348422b8ae8ef1b2513d2fe
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
6492105
28917811
001
10135
25921013
6991111
29917828
6192101

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x3b7d8410
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.0
SizeOfCode0x12800
SizeOfInitializedData0x9c00
SizeOfUninitializedData0
AddressOfEntryPoint0x12475
BaseOfCode0x1000
BaseOfData0x14000
ImageBase0x1000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion5.1
SubsystemVersion4.0
Reserved10
SizeOfImage0x30000
SizeOfHeaders0x400
CheckSum0x21f0a
Subsystem2
DllCharacteristics0x8000
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.x >> *SigBy Ahmed18

Sections

namevavsizeraw sizeflags
.text0x10000x126b00x12800RWX CODE
.data0x140000x101c0xa00RW- IDATA
.rsrc0x160000x1a0000x8a00RWX IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x12b800x8c
RESOURCE0x160000x8960
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x12400x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT0x2600x80
IAT0x10000x228
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
ICON#22960
ICON#337520
ICON#422160
ICON#513840
ICON#696400
ICON#742640
ICON#811280
MENU#1062800
MENU#1074700
MENU#1084840
MENU#109400
DIALOG#10130640
DIALOG#10211960
DIALOG#1033080
DIALOG#1045000
STRING#11120
STRING#21200
STRING#3880
STRING#4800
STRING#57220
STRING#63140
ACCELERATORS#1057600
GROUP_ICONSC1180
VERSION#19080
MANIFEST#16670
idlangstring
01033+/-
11033C
21033CE
31033Backspace
41033Sta
51033.
61033And
71033Or
81033Xor
91033Lsh
101033/
111033*
121033+
131033-
141033Mod
151033x^y
161033Int
171033Not
181033sin
191033cos
201033tan
211033ln
221033log
231033sqrt
241033x^2
251033x^3
261033n!
2710331/x
281033dms
291033%
301033F-E
311033pi
321033=
331033MC
341033MR
351033MS
361033M+
371033Exp
381033Ave
391033Sum
401033s
411033Dat
421033(
431033)
4410330
4510331
4610332
4710333
4810334
4910335
5010336
5110337
5210338
5310339
541033A
551033B
561033C
571033D
581033E
591033F
601033Hex
611033Dec
621033Oct
631033Bin
641033Qword
651033Dword
661033Word
671033Byte
681033Degrees
691033Radians
701033Grads
711033Cannot divide by zero.
721033Invalid input for function.
731033Result of function is undefined.
741033Error: Positive Infinity.
751033Error: Negative Infinity.
761033Operation was canceled.
771033Calc does not have enough memory to continue.
781033The requested function may take a very long time to complete. Do you want to abort the operation now?
791033calc.hlp
801033Cannot open Clipboard.
811033There is not enough memory for data. Close one or more programs, and then try again.
821033calc.chm
831033Calculator
841033Not Enough Memory
module_namehintordfunction_name
SHELL32.dll148ShellAboutW
msvcrt.dll82__CxxFrameHandler
msvcrt.dll71_CxxThrowException
msvcrt.dll824wcstoul
msvcrt.dll794toupper
msvcrt.dll806wcschr
msvcrt.dll734memmove
msvcrt.dll812wcslen
msvcrt.dll559_wcsrev
msvcrt.dll197_c_exit
msvcrt.dll246_exit
msvcrt.dll78_XcptFilter
msvcrt.dll200_cexit
msvcrt.dll655exit
msvcrt.dll168_acmdln
msvcrt.dll109__getmainargs
msvcrt.dll314_initterm
msvcrt.dll154__setusermatherr
msvcrt.dll182_adjust_fdiv
msvcrt.dll128__p__commode
msvcrt.dll133__p__fmode
msvcrt.dll152__set_app_type
msvcrt.dll18void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll16public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

msvcrt.dll214_controlfp
msvcrt.dll237_except_handler3
msvcrt.dll52void __cdecl terminate(void)

?terminate@@YAXXZ

ADVAPI32.dll481RegOpenKeyExA
ADVAPI32.dll491RegQueryValueExA
ADVAPI32.dll456RegCloseKey
KERNEL32.dll359GetModuleHandleA
KERNEL32.dll558LoadLibraryA
KERNEL32.dll393GetProcAddress
KERNEL32.dll472GlobalCompact
KERNEL32.dll471GlobalAlloc
KERNEL32.dll478GlobalFree
KERNEL32.dll485GlobalReAlloc
KERNEL32.dll915lstrcmpW
KERNEL32.dll809Sleep
KERNEL32.dll899WriteProfileStringW
KERNEL32.dll412GetStartupInfoA
KERNEL32.dll486GlobalSize
KERNEL32.dll489GlobalUnlock
KERNEL32.dll71CreateEventW
KERNEL32.dll101CreateThread
KERNEL32.dll681ResetEvent
KERNEL32.dll924lstrcpynW
KERNEL32.dll748SetEvent
KERNEL32.dll869WaitForSingleObject
KERNEL32.dll44CloseHandle
KERNEL32.dll912lstrcatW
KERNEL32.dll927lstrlenW
KERNEL32.dll571LocalReAlloc
KERNEL32.dll568LocalFree
KERNEL32.dll564LocalAlloc
KERNEL32.dll408GetProfileStringW
KERNEL32.dll482GlobalLock
KERNEL32.dll254GetCommandLineW
KERNEL32.dll921lstrcpyW
KERNEL32.dll404GetProfileIntW
GDI32.dll531SetBkColor
GDI32.dll570SetTextColor
GDI32.dll532SetBkMode
USER32.dll300GetMenu
USER32.dll594SetDlgItemInt
USER32.dll378GetWindowTextW
USER32.dll56CheckDlgButton
USER32.dll383HideCaret
USER32.dll28CallWindowProcW
USER32.dll191DrawTextW
USER32.dll723WinHelpW
USER32.dll513PostQuitMessage
USER32.dll272GetDlgCtrlID
USER32.dll561ScreenToClient
USER32.dll60ChildWindowFromPoint
USER32.dll143DefWindowProcW
USER32.dll415IsClipboardFormatAvailable
USER32.dll194EnableMenuItem
USER32.dll677TrackPopupMenuEx
USER32.dll270GetDesktopWindow
USER32.dll499OpenClipboard
USER32.dll257GetClipboardData
USER32.dll42CharNextA
USER32.dll66CloseClipboard
USER32.dll346GetSysColor
USER32.dll159DialogBoxParamW
USER32.dll198EndDialog
USER32.dll475MessageBeep
USER32.dll345GetSubMenu
USER32.dll59CheckRadioButton
USER32.dll647SetWindowTextW
USER32.dll598SetFocus
USER32.dll589SetCursor
USER32.dll44CharNextW
USER32.dll536RegisterClassExW
USER32.dll347GetSysColorBrush
USER32.dll442LoadCursorW
USER32.dll444LoadIconW
USER32.dll403InvalidateRect
USER32.dll699UpdateWindow
USER32.dll658ShowWindow
USER32.dll576SendMessageW
USER32.dll596SetDlgItemTextW
USER32.dll57CheckMenuItem
USER32.dll58CheckMenuRadioItem
USER32.dll643SetWindowPos
USER32.dll498OffsetRect
USER32.dll471MapWindowPoints
USER32.dll255GetClientRect
USER32.dll196EnableWindow
USER32.dll454LoadMenuW
USER32.dll641SetWindowLongW
USER32.dll367GetWindowLongW
USER32.dll86CreateDialogParamW
USER32.dll273GetDlgItem
USER32.dll151DestroyMenu
USER32.dll153DestroyWindow
USER32.dll605SetMenu
USER32.dll372GetWindowRect
USER32.dll666SystemParametersInfoW
USER32.dll162DispatchMessageW
USER32.dll682TranslateMessage
USER32.dll680TranslateAcceleratorW
USER32.dll414IsChild
USER32.dll418IsDialogMessageW
USER32.dll318GetMessageW
USER32.dll436LoadAcceleratorsW
USER32.dll97CreateWindowExW
USER32.dll483MessageBoxW
USER32.dll457LoadStringW
USER32.dll615SetProcessDefaultLayout
USER32.dll327GetProcessDefaultLayout

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionWindows Calculator application file
FileVersion5.1.2600.0 (xpclient.010817-1148)
InternalNameCALC
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCALC.EXE
ProductNameMicrosoft® Windows® Operating System
ProductVersion5.1.2600.0

VS_FIXEDFILEINFO

FileVersion5.1.2600.0
ProductVersion5.1.2600.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0114688EXE08/17/2001 20:52:32#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x260