File cftmon_3c4444c8339f2b4c04931a379daf9d041854b168e45f949515f90b124821d626.exe
Function:
Loading..
00400000
00400000 struct IMAGE_DOS_HEADER
00400000 struct IMAGE_DOS_HEADER
00400000 e_magic uint16 0x5a4d ; IMAGE_DOS_SIGNATURE
00400002 e_cblp int 144
00400004 e_cp int 3
00400006 e_crlc int 0
00400008 e_cparhdr int 4
0040000a e_minalloc int 0
0040000c e_maxalloc int 65535
0040000e e_ss uint16 0x0000
00400010 e_sp uint16 0x00b8
00400012 e_csum uint16 0x0000
00400014 e_ip uint16 0x0000
00400016 e_cs uint16 0x0000
00400018 e_lfarlc uint16 0x0040
0040001a e_ovno int 0
0040001c e_res [4]uint16 {0, 0, 0, 0}
00400024 e_oemid uint16 0x0000
00400026 e_oeminfo uint16 0x0000
00400028 e_res2 [10]uint16 {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
0040003c e_lfanew uint32 0x4000b8
00400002 e_cblp int 144
00400004 e_cp int 3
00400006 e_crlc int 0
00400008 e_cparhdr int 4
0040000a e_minalloc int 0
0040000c e_maxalloc int 65535
0040000e e_ss uint16 0x0000
00400010 e_sp uint16 0x00b8
00400012 e_csum uint16 0x0000
00400014 e_ip uint16 0x0000
00400016 e_cs uint16 0x0000
00400018 e_lfarlc uint16 0x0040
0040001a e_ovno int 0
0040001c e_res [4]uint16 {0, 0, 0, 0}
00400024 e_oemid uint16 0x0000
00400026 e_oeminfo uint16 0x0000
00400028 e_res2 [10]uint16 {0, 0, 0, 0, 0, 0, 0, 0, 0, 0}
0040003c e_lfanew uint32 0x4000b8
00400040
00400040 struct IMAGE_DOS_STUB
00400040 struct IMAGE_DOS_STUB
00400040 PushCS uint8 0x0e
00400041 PopDS uint8 0x1f
00400042 MovDX uint8 0xba
00400043 MessageOffset uint16 0x40004e
00400045 MovAH9 uint16 0x09b4
00400047 Int21Print uint16 0x21cd
00400049 MovAX uint8 0xb8
0040004a ExitCode uint16 0x4c01
0040004c Int21Exit uint16 0x21cd
0040004e Message ascii "This program cannot be run in DOS mode.\r\r\n$"
00400079
00400079 00 00 00 00 00 00 00 .......
00400080
00400080 struct IMAGE_RICH_HEADER
00400080 DanS uint32 0x536e6144 ; DanS
00400084 Padding [3]uint32 {0, 0, 0}
00400090
00400090 struct IMAGE_RICH_ENTRY
00400090 BuildNumber int 7299
00400092 ProductId int 14
00400094 Count int 1
00400098
00400098 struct IMAGE_RICH_ENTRY
00400098 BuildNumber int 8041
0040009a ProductId int 9
0040009c Count int 1
004000a0
004000a0 struct IMAGE_RICH_ENTRY
004000a0 BuildNumber int 8169
004000a2 ProductId int 13
004000a4 Count int 1
004000a8
004000a8 struct IMAGE_RICH_FOOTER
004000a8 Signature uint32 0x68636952 ; Rich
004000ac Key uint32 0x8897ebcb
004000b0
004000b0 // align 0x8
00400041 PopDS uint8 0x1f
00400042 MovDX uint8 0xba
00400043 MessageOffset uint16 0x40004e
00400045 MovAH9 uint16 0x09b4
00400047 Int21Print uint16 0x21cd
00400049 MovAX uint8 0xb8
0040004a ExitCode uint16 0x4c01
0040004c Int21Exit uint16 0x21cd
0040004e Message ascii "This program cannot be run in DOS mode.\r\r\n$"
00400079
00400079 00 00 00 00 00 00 00 .......
00400080
00400080 struct IMAGE_RICH_HEADER
00400080 DanS uint32 0x536e6144 ; DanS
00400084 Padding [3]uint32 {0, 0, 0}
00400090
00400090 struct IMAGE_RICH_ENTRY
00400090 BuildNumber int 7299
00400092 ProductId int 14
00400094 Count int 1
00400098
00400098 struct IMAGE_RICH_ENTRY
00400098 BuildNumber int 8041
0040009a ProductId int 9
0040009c Count int 1
004000a0
004000a0 struct IMAGE_RICH_ENTRY
004000a0 BuildNumber int 8169
004000a2 ProductId int 13
004000a4 Count int 1
004000a8
004000a8 struct IMAGE_RICH_FOOTER
004000a8 Signature uint32 0x68636952 ; Rich
004000ac Key uint32 0x8897ebcb
004000b0
004000b0 // align 0x8
004000b8
004000b8 struct IMAGE_NT_HEADERS
004000b8 struct IMAGE_NT_HEADERS
004000b8 Signature uint32 0x00004550 ; IMAGE_NT_SIGNATURE — "PE\0\0" magic
004000bc FileHeader.Machine uint16 0x014c ; IMAGE_FILE_MACHINE_I386
004000be FileHeader.NumberOfSections int 3
004000c0 FileHeader.TimeDateStamp uint32 0x55a501a3
004000c4 FileHeader.PointerToSymbolTable uint32 0x00000000
004000c8 FileHeader.NumberOfSymbols int 0
004000cc FileHeader.SizeOfOptionalHeader int 224
004000ce FileHeader.Characteristics uint16 0x010f ; IMAGE_FILE_RELOCS_STRIPPED|IMAGE_FILE_EXECUTABLE_IMAGE|IMAGE_FILE_LINE_NUMS_STRIPPED|IMAGE_FILE_LOCAL_SYMS_STRIPPED|IMAGE_FILE_32BIT_MACHINE
004000d0 OptionalHeader.Magic uint16 0x010b ; PE32 (x86_32)
004000d2 OptionalHeader.MajorLinkerVersion int 6
004000d3 OptionalHeader.MinorLinkerVersion int 0
004000d4 OptionalHeader.SizeOfCode int 36864
004000d8 OptionalHeader.SizeOfInitializedData int 8192
004000dc OptionalHeader.SizeOfUninitializedData int 0
004000e0 OptionalHeader.AddressOfEntryPoint uint32 0x4016c4
004000e4 OptionalHeader.BaseOfCode uint32 0x00001000
004000e8 OptionalHeader.BaseOfData uint32 0x0000a000
004000ec OptionalHeader.ImageBase uint32 0x00400000
004000f0 OptionalHeader.SectionAlignment uint32 0x00001000
004000f4 OptionalHeader.FileAlignment uint32 0x00001000
004000f8 OptionalHeader.MajorOperatingSystemVersion int 4
004000fa OptionalHeader.MinorOperatingSystemVersion int 0
004000fc OptionalHeader.MajorImageVersion int 3
004000fe OptionalHeader.MinorImageVersion int 5
00400100 OptionalHeader.MajorSubsystemVersion int 4
00400102 OptionalHeader.MinorSubsystemVersion int 0
00400104 OptionalHeader.Win32VersionValue uint32 0x00000000
00400108 OptionalHeader.SizeOfImage uint32 0x0000c000
0040010c OptionalHeader.SizeOfHeaders uint32 0x00001000
00400110 OptionalHeader.CheckSum uint32 0x000158b8
00400114 OptionalHeader.Subsystem uint16 0x0002 ; IMAGE_SUBSYSTEM_WINDOWS_GUI
00400116 OptionalHeader.DllCharacteristics uint16 0x0000
00400118 OptionalHeader.SizeOfStackReserve uint32 0x00100000
0040011c OptionalHeader.SizeOfStackCommit uint32 0x00001000
00400120 OptionalHeader.SizeOfHeapReserve uint32 0x00100000
00400124 OptionalHeader.SizeOfHeapCommit uint32 0x00001000
00400128 OptionalHeader.LoaderFlags uint32 0x00000000
0040012c OptionalHeader.NumberOfRvaAndSizes int 16
00400130 OptionalHeader.DataDirectory.ExportTable.VirtualAddress uint32 0x00000000
00400134 OptionalHeader.DataDirectory.ExportTable.Size int 0
00400138 OptionalHeader.DataDirectory.ImportTable.VirtualAddress uint32 0x4098d4
0040013c OptionalHeader.DataDirectory.ImportTable.Size int 40
00400140 OptionalHeader.DataDirectory.Resource.VirtualAddress uint32 0x0000b000
00400144 OptionalHeader.DataDirectory.Resource.Size int 2196
00400148 OptionalHeader.DataDirectory.Exception.VirtualAddress uint32 0x00000000
0040014c OptionalHeader.DataDirectory.Exception.Size int 0
00400150 OptionalHeader.DataDirectory.Security.VirtualAddress uint32 0x00000000
00400154 OptionalHeader.DataDirectory.Security.Size int 0
00400158 OptionalHeader.DataDirectory.BaseReloc.VirtualAddress uint32 0x00000000
0040015c OptionalHeader.DataDirectory.BaseReloc.Size int 0
00400160 OptionalHeader.DataDirectory.Debug.VirtualAddress uint32 0x00000000
00400164 OptionalHeader.DataDirectory.Debug.Size int 0
00400168 OptionalHeader.DataDirectory.Architecture.VirtualAddress uint32 0x00000000
0040016c OptionalHeader.DataDirectory.Architecture.Size int 0
00400170 OptionalHeader.DataDirectory.GlobalPtr.VirtualAddress uint32 0x00000000
00400174 OptionalHeader.DataDirectory.GlobalPtr.Size int 0
00400178 OptionalHeader.DataDirectory.TLS.VirtualAddress uint32 0x00000000
0040017c OptionalHeader.DataDirectory.TLS.Size int 0
00400180 OptionalHeader.DataDirectory.LoadConfig.VirtualAddress uint32 0x00000000
00400184 OptionalHeader.DataDirectory.LoadConfig.Size int 0
00400188 OptionalHeader.DataDirectory.BoundImport.VirtualAddress uint32 0x400228
0040018c OptionalHeader.DataDirectory.BoundImport.Size int 32
00400190 OptionalHeader.DataDirectory.IAT.VirtualAddress uint32 0x401000
00400194 OptionalHeader.DataDirectory.IAT.Size int 368
00400198 OptionalHeader.DataDirectory.DelayImport.VirtualAddress uint32 0x00000000
0040019c OptionalHeader.DataDirectory.DelayImport.Size int 0
004001a0 OptionalHeader.DataDirectory.CLRRuntime.VirtualAddress uint32 0x00000000
004001a4 OptionalHeader.DataDirectory.CLRRuntime.Size int 0
004001a8 OptionalHeader.DataDirectory.Reserved.VirtualAddress uint32 0x00000000
004001ac OptionalHeader.DataDirectory.Reserved.Size int 0
004000bc FileHeader.Machine uint16 0x014c ; IMAGE_FILE_MACHINE_I386
004000be FileHeader.NumberOfSections int 3
004000c0 FileHeader.TimeDateStamp uint32 0x55a501a3
004000c4 FileHeader.PointerToSymbolTable uint32 0x00000000
004000c8 FileHeader.NumberOfSymbols int 0
004000cc FileHeader.SizeOfOptionalHeader int 224
004000ce FileHeader.Characteristics uint16 0x010f ; IMAGE_FILE_RELOCS_STRIPPED|IMAGE_FILE_EXECUTABLE_IMAGE|IMAGE_FILE_LINE_NUMS_STRIPPED|IMAGE_FILE_LOCAL_SYMS_STRIPPED|IMAGE_FILE_32BIT_MACHINE
004000d0 OptionalHeader.Magic uint16 0x010b ; PE32 (x86_32)
004000d2 OptionalHeader.MajorLinkerVersion int 6
004000d3 OptionalHeader.MinorLinkerVersion int 0
004000d4 OptionalHeader.SizeOfCode int 36864
004000d8 OptionalHeader.SizeOfInitializedData int 8192
004000dc OptionalHeader.SizeOfUninitializedData int 0
004000e0 OptionalHeader.AddressOfEntryPoint uint32 0x4016c4
004000e4 OptionalHeader.BaseOfCode uint32 0x00001000
004000e8 OptionalHeader.BaseOfData uint32 0x0000a000
004000ec OptionalHeader.ImageBase uint32 0x00400000
004000f0 OptionalHeader.SectionAlignment uint32 0x00001000
004000f4 OptionalHeader.FileAlignment uint32 0x00001000
004000f8 OptionalHeader.MajorOperatingSystemVersion int 4
004000fa OptionalHeader.MinorOperatingSystemVersion int 0
004000fc OptionalHeader.MajorImageVersion int 3
004000fe OptionalHeader.MinorImageVersion int 5
00400100 OptionalHeader.MajorSubsystemVersion int 4
00400102 OptionalHeader.MinorSubsystemVersion int 0
00400104 OptionalHeader.Win32VersionValue uint32 0x00000000
00400108 OptionalHeader.SizeOfImage uint32 0x0000c000
0040010c OptionalHeader.SizeOfHeaders uint32 0x00001000
00400110 OptionalHeader.CheckSum uint32 0x000158b8
00400114 OptionalHeader.Subsystem uint16 0x0002 ; IMAGE_SUBSYSTEM_WINDOWS_GUI
00400116 OptionalHeader.DllCharacteristics uint16 0x0000
00400118 OptionalHeader.SizeOfStackReserve uint32 0x00100000
0040011c OptionalHeader.SizeOfStackCommit uint32 0x00001000
00400120 OptionalHeader.SizeOfHeapReserve uint32 0x00100000
00400124 OptionalHeader.SizeOfHeapCommit uint32 0x00001000
00400128 OptionalHeader.LoaderFlags uint32 0x00000000
0040012c OptionalHeader.NumberOfRvaAndSizes int 16
00400130 OptionalHeader.DataDirectory.ExportTable.VirtualAddress uint32 0x00000000
00400134 OptionalHeader.DataDirectory.ExportTable.Size int 0
00400138 OptionalHeader.DataDirectory.ImportTable.VirtualAddress uint32 0x4098d4
0040013c OptionalHeader.DataDirectory.ImportTable.Size int 40
00400140 OptionalHeader.DataDirectory.Resource.VirtualAddress uint32 0x0000b000
00400144 OptionalHeader.DataDirectory.Resource.Size int 2196
00400148 OptionalHeader.DataDirectory.Exception.VirtualAddress uint32 0x00000000
0040014c OptionalHeader.DataDirectory.Exception.Size int 0
00400150 OptionalHeader.DataDirectory.Security.VirtualAddress uint32 0x00000000
00400154 OptionalHeader.DataDirectory.Security.Size int 0
00400158 OptionalHeader.DataDirectory.BaseReloc.VirtualAddress uint32 0x00000000
0040015c OptionalHeader.DataDirectory.BaseReloc.Size int 0
00400160 OptionalHeader.DataDirectory.Debug.VirtualAddress uint32 0x00000000
00400164 OptionalHeader.DataDirectory.Debug.Size int 0
00400168 OptionalHeader.DataDirectory.Architecture.VirtualAddress uint32 0x00000000
0040016c OptionalHeader.DataDirectory.Architecture.Size int 0
00400170 OptionalHeader.DataDirectory.GlobalPtr.VirtualAddress uint32 0x00000000
00400174 OptionalHeader.DataDirectory.GlobalPtr.Size int 0
00400178 OptionalHeader.DataDirectory.TLS.VirtualAddress uint32 0x00000000
0040017c OptionalHeader.DataDirectory.TLS.Size int 0
00400180 OptionalHeader.DataDirectory.LoadConfig.VirtualAddress uint32 0x00000000
00400184 OptionalHeader.DataDirectory.LoadConfig.Size int 0
00400188 OptionalHeader.DataDirectory.BoundImport.VirtualAddress uint32 0x400228
0040018c OptionalHeader.DataDirectory.BoundImport.Size int 32
00400190 OptionalHeader.DataDirectory.IAT.VirtualAddress uint32 0x401000
00400194 OptionalHeader.DataDirectory.IAT.Size int 368
00400198 OptionalHeader.DataDirectory.DelayImport.VirtualAddress uint32 0x00000000
0040019c OptionalHeader.DataDirectory.DelayImport.Size int 0
004001a0 OptionalHeader.DataDirectory.CLRRuntime.VirtualAddress uint32 0x00000000
004001a4 OptionalHeader.DataDirectory.CLRRuntime.Size int 0
004001a8 OptionalHeader.DataDirectory.Reserved.VirtualAddress uint32 0x00000000
004001ac OptionalHeader.DataDirectory.Reserved.Size int 0
004001b0
004001b0 struct IMAGE_SECTION_HEADER
004001b0 struct IMAGE_SECTION_HEADER
004001b0 Name ascii ".text"
004001b8 VirtualSize uint32 0x00008ec4
004001bc VirtualAddress uint32 0x401000
004001c0 SizeOfRawData uint32 0x00009000
004001c4 PointerToRawData uint32 0x00001000
004001c8 PointerToRelocations uint32 0x00000000
004001cc PointerToLineNumbers uint32 0x00000000
004001d0 NumberOfRelocations int 0
004001d2 NumberOfLineNumbers int 0
004001d4 Characteristics uint32 0x60000020 ; IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
004001b8 VirtualSize uint32 0x00008ec4
004001bc VirtualAddress uint32 0x401000
004001c0 SizeOfRawData uint32 0x00009000
004001c4 PointerToRawData uint32 0x00001000
004001c8 PointerToRelocations uint32 0x00000000
004001cc PointerToLineNumbers uint32 0x00000000
004001d0 NumberOfRelocations int 0
004001d2 NumberOfLineNumbers int 0
004001d4 Characteristics uint32 0x60000020 ; IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
004001d8
004001d8 struct IMAGE_SECTION_HEADER
004001d8 struct IMAGE_SECTION_HEADER
004001d8 Name ascii ".data"
004001e0 VirtualSize uint32 0x00000afc
004001e4 VirtualAddress uint32 0x40a000
004001e8 SizeOfRawData uint32 0x00001000
004001ec PointerToRawData uint32 0x0000a000
004001f0 PointerToRelocations uint32 0x00000000
004001f4 PointerToLineNumbers uint32 0x00000000
004001f8 NumberOfRelocations int 0
004001fa NumberOfLineNumbers int 0
004001fc Characteristics uint32 0xc0000040 ; IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
004001e0 VirtualSize uint32 0x00000afc
004001e4 VirtualAddress uint32 0x40a000
004001e8 SizeOfRawData uint32 0x00001000
004001ec PointerToRawData uint32 0x0000a000
004001f0 PointerToRelocations uint32 0x00000000
004001f4 PointerToLineNumbers uint32 0x00000000
004001f8 NumberOfRelocations int 0
004001fa NumberOfLineNumbers int 0
004001fc Characteristics uint32 0xc0000040 ; IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
00400200
00400200 struct IMAGE_SECTION_HEADER
00400228 00400200 struct IMAGE_SECTION_HEADER
00400200 Name ascii ".rsrc"
00400208 VirtualSize uint32 0x00000894
0040020c VirtualAddress uint32 0x40b000
00400210 SizeOfRawData uint32 0x00001000
00400214 PointerToRawData uint32 0x0000b000
00400218 PointerToRelocations uint32 0x00000000
0040021c PointerToLineNumbers uint32 0x00000000
00400220 NumberOfRelocations int 0
00400222 NumberOfLineNumbers int 0
00400224 Characteristics uint32 0x40000040 ; IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
00400208 VirtualSize uint32 0x00000894
0040020c VirtualAddress uint32 0x40b000
00400210 SizeOfRawData uint32 0x00001000
00400214 PointerToRawData uint32 0x0000b000
00400218 PointerToRelocations uint32 0x00000000
0040021c PointerToLineNumbers uint32 0x00000000
00400220 NumberOfRelocations int 0
00400222 NumberOfLineNumbers int 0
00400224 Characteristics uint32 0x40000040 ; IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
00400228 struct IMAGE_BOUND_IMPORT_DESCRIPTOR
00400228 TimeDateStamp uint32 0x4a5bda6c
0040022c OffsetModuleName uint16 0x400238
0040022e NumberOfModuleForwarderRefs int 0
00400230
00400230 struct IMAGE_BOUND_IMPORT_DESCRIPTOR
00400230 TimeDateStamp uint32 0x00000000
00400234 OffsetModuleName uint16 0x0000
00400236 NumberOfModuleForwarderRefs int 0
00400238
00400238 string "MSVBVM60.DLL",0
00400245
00400245 00 00 00 00 00 00 00 00 00 00 00 ...........
00400250 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
*
00401000
00401000
00401000 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32 ← 0x400190 0x4098e4
00401000 AddressOfData uint32 0x72a20507
00401004
00401004 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401004 AddressOfData uint32 0x72a39386
00401008
00401008 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401008 AddressOfData uint32 0x72a309f9
0040100c
0040100c struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
0040100c AddressOfData uint32 0x72a46831
00401010
00401010 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401010 AddressOfData uint32 0x72a21929
00401014
00401014 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401014 AddressOfData uint32 0x72a26a9b
00401018
00401018 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401018 AddressOfData uint32 0x72a47262
0040101c
0040101c struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
0040101c AddressOfData uint32 0x72a302ba
00401020
00401020 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401020 AddressOfData uint32 0x72a19fc3
00401024
00401024 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401024 AddressOfData uint32 0x72a30941
00401028
00401028 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401028 AddressOfData uint32 0x72a26a76
0040102c
0040102c struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
0040102c AddressOfData uint32 0x72a276e5
00401030
00401030 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401030 AddressOfData uint32 0x72a11b17
00401034
00401034 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401034 AddressOfData uint32 0x72a0c33a
00401038
00401038 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401038 AddressOfData uint32 0x72a1a274
0040103c
0040103c struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
0040103c AddressOfData uint32 0x72a3026e
00401040
00401040 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401040 AddressOfData uint32 0x72a1db35
00401044
00401044 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401044 AddressOfData uint32 0x72a24a48
00401048
00401048 struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
00401048 AddressOfData uint32 0x72a14191
0040104c
0040104c struct IMAGE_IMPORT_ADDRESS_TABLE_ENTRY32
0040104c AddressOfData uint32 0x72a2499d
Loading..