architecture: i386, flags 0x0000010a:
EXEC_P, HAS_DEBUG, D_PAGED
start address 0x00401350
Characteristics 0x10f
relocations stripped
executable
line numbers stripped
symbols stripped
32 bit words
Time/Date Sat Dec 22 14:56:04 2007
Magic 010b (PE32)
MajorLinkerVersion 7
MinorLinkerVersion 10
SizeOfCode 00000400
SizeOfInitializedData 00062800
SizeOfUninitializedData 00000000
AddressOfEntryPoint 0000000000001350
BaseOfCode 0000000000001000
BaseOfData 0000000000002000
ImageBase 0000000000400000
SectionAlignment 0000000000001000
FileAlignment 0000000000000200
MajorOSystemVersion 4
MinorOSystemVersion 0
MajorImageVersion 0
MinorImageVersion 0
MajorSubsystemVersion 4
MinorSubsystemVersion 0
Win32Version 00000000
SizeOfImage 00067000
SizeOfHeaders 00000400
CheckSum 00000000
Subsystem 00000002 (Windows GUI)
DllCharacteristics 00000400
SizeOfStackReserve 0000000000100000
SizeOfStackCommit 0000000000001000
SizeOfHeapReserve 0000000000100000
SizeOfHeapCommit 0000000000001000
LoaderFlags 00000000
NumberOfRvaAndSizes 00000010
The Data Directory
Entry 0 0000000000000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 00000000000020ac 00000050 Import Directory [parts of .idata]
Entry 2 0000000000004000 0006227c Resource Directory [.rsrc]
Entry 3 0000000000000000 00000000 Exception Directory [.pdata]
Entry 4 0000000000000000 00000000 Security Directory
Entry 5 0000000000000000 00000000 Base Relocation Directory [.reloc]
Entry 6 0000000000002080 0000001c Debug Directory
Entry 7 0000000000000000 00000000 Description Directory
Entry 8 0000000000000000 00000000 Special Directory
Entry 9 0000000000000000 00000000 Thread Storage Directory [.tls]
Entry a 0000000000000000 00000000 Load Configuration Directory
Entry b 0000000000000000 00000000 Bound Import Directory
Entry c 0000000000002000 00000074 Import Address Table Directory
Entry d 0000000000000000 00000000 Delay Import Directory
Entry e 0000000000000000 00000000 CLR Runtime Header
Entry f 0000000000000000 00000000 Reserved
There is an import table in .rdata at 0x4020ac
The Import Tables (interpreted .rdata section contents)
vma: Hint Time Forward DLL First
Table Stamp Chain Name Thunk
000020ac 00002154 00000000 00000000 000021a8 00002058
DLL Name: SHLWAPI.dll
vma: Hint/Ord Member-Name Bound-To
2190 105 PathRemoveExtensionA
217a 41 PathFindExtensionA
2170 211 StrChrA
000020c0 000020fc 00000000 00000000 00002308 00002000
DLL Name: KERNEL32.dll
vma: Hint/Ord Member-Name Bound-To
2250 338 GetExitCodeProcess
22f8 105 CreateThread
22ea 175 ExitProcess
22da 218 FindResourceA
21b4 46 CloseHandle
21c2 916 WriteFile
21ce 77 CreateFileA
21dc 838 SizeofResource
21ee 603 LockResource
21fe 589 LoadResource
220e 219 FindResourceExA
2220 239 FreeLibrary
222e 408 GetProcAddress
2240 584 LoadLibraryA
22c4 373 GetModuleFileNameA
2266 899 WaitForSingleObject
227c 96 CreateProcessA
228e 956 lstrlenA
229a 264 GetCommandLineA
22ac 941 lstrcatA
22b8 950 lstrcpyA
000020d4 00002164 00000000 00000000 00002330 00002068
DLL Name: USER32.dll
vma: Hint/Ord Member-Name Bound-To
2324 726 wsprintfA
2316 458 LoadStringA
000020e8 00000000 00000000 00000000 00000000 00000000
Sections:
Idx Name Size VMA LMA File off Algn
0 .text 00000388 00401000 00401000 00000400 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
1 .rdata 0000037b 00402000 00402000 00000800 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
2 .data 00000000 00403000 00403000 00000000 2**2
ALLOC, LOAD, DATA
3 .rsrc 0006227c 00404000 00404000 00000c00 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
|