International Burmese democratic forces and friends of Burma who

21

Click here to load reader

Transcript of International Burmese democratic forces and friends of Burma who

Page 1: International Burmese democratic forces and friends of Burma who

WINDOWS EXECUTABLE

32bit for Windows 95 and Windows NT

 

Technical File Information:

 

Image File Header 

Signature: 00004550

Machine: Intel 386

Number of Sections: 0008

Time Date Stamp: 2a425e19

Symbols Pointer: 00000000

Number of Symbols: 00000000

Size of Optional Header 00e0

Characteristics: File is executable  (i.e. no unresolved external references). Line numbers stripped from file. Local symbols stripped from file. Low bytes of machine word are reversed. 32 bit word machine. High bytes of machine word are reversed. 

 

 

Image Optional Header 

Magic: 010b

Linker Version: 2.25

Size of Code: 00017000

Size of Initialized Data: 00004c00

Size of Uninitialized Data: 00000000

Address of Entry Point: 00017de0

Base of Code: 00001000

Base of Data: 00018000

Image Base: 00400000

Page 2: International Burmese democratic forces and friends of Burma who

Section Alignment: 00001000

File Alignment: 00000200

Operating System Version: 4.00

Image Version: 0.00

Subsystem Version: 4.00

Reserved1: 00000000

Size of Image: 00022000

Size of Headers: 00000400

Checksum: 00026338

Subsystem: Image runs in the Windows GUI subsystem.

DLL Characteristics: 0000

Size of Stack Reserve: 00100000

Size of Stack Commit: 00004000

Size of Heap Reserve: 00100000

Size of Heap Commit: 00001000

Loader Flags: 00000000

Size of Data Directory: 00000010

Import Directory Virtual Address:  0001a000

Import Directory Size:  000014d0

Resource Directory  

Virtual Address:  00020000

Resource Directory Size:  000018c8

Base Relocation Table  

Virtual Address:  0001e000

Base Relocation Table Size:  000011c4

TLS Directory Virtual Address:  0001d000

TLS Directory Size:  00000018

 

Page 3: International Burmese democratic forces and friends of Burma who

  

 

 

Import Table 

kernel32.dll

Ordinal Function Name 

 

0000 GetCurrentThreadId

0000 WideCharToMultiByte

0000 ExitProcess

0000 UnhandledExceptionFilter

0000 RtlUnwind

0000 RaiseException

0000 TlsSetValue

0000 TlsGetValue

0000 LocalAlloc

0000 GetModuleHandleA

0000 FreeLibrary

0000 HeapFree

0000 HeapReAlloc

0000 HeapAlloc

0000 GetProcessHeap

 

 

oleaut32.dll

Ordinal Function Name 

 

0000 SysFreeString

Page 4: International Burmese democratic forces and friends of Burma who

0000 SysReAllocStringLen

 

 

advapi32.dll

Ordinal Function Name 

 

0000 RegSetValueExA

0000 RegQueryValueExA

0000 RegQueryInfoKeyA

0000 RegOpenKeyExA

0000 RegEnumKeyExA

0000 RegCreateKeyExA

0000 RegCloseKey

0000 OpenThreadToken

0000 OpenProcessToken

0000 LookupPrivilegeValueA

0000 GetUserNameA

0000 GetTokenInformation

0000 FreeSid

0000 EqualSid

0000 AllocateAndInitializeSid

0000 AdjustTokenPrivileges

 

 

kernel32.dll

Ordinal Function Name 

 

0000 WritePrivateProfileStringA

Page 5: International Burmese democratic forces and friends of Burma who

0000 WriteFile

0000 WinExec

0000 WaitForSingleObject

0000 TerminateProcess

0000 Sleep

0000 SetFileTime

0000 SetFilePointer

0000 SetFileAttributesA

0000 SetErrorMode

0000 SetEndOfFile

0000 SetCurrentDirectoryA

0000 RemoveDirectoryA

0000 ReadFile

0000 OpenProcess

0000 MultiByteToWideChar

0000 LocalFileTimeToFileTime

0000 LoadLibraryA

0000 GlobalFree

0000 GlobalAlloc

0000 GetWindowsDirectoryA

0000 GetVersionExA

0000 GetVersion

0000 GetUserDefaultLangID

0000 GetTimeFormatA

0000 GetTempPathA

0000 GetSystemDirectoryA

0000 GetShortPathNameA

0000 GetProcAddress

0000 GetPrivateProfileStringA

Page 6: International Burmese democratic forces and friends of Burma who

0000 GetModuleHandleA

0000 GetModuleFileNameA

0000 GetLastError

0000 GetFullPathNameA

0000 GetFileTime

0000 GetFileSize

0000 GetFileAttributesA

0000 GetExitCodeProcess

0000 GetDiskFreeSpaceA

0000 GetDateFormatA

0000 GetCurrentThread

0000 GetCurrentProcess

0000 GetComputerNameA

0000 GetCommandLineA

0000 FreeLibrary

0000 FormatMessageA

0000 FindNextFileA

0000 FindFirstFileA

0000 FindClose

0000 FileTimeToSystemTime

0000 FileTimeToLocalFileTime

0000 ExpandEnvironmentStringsA

0000 DosDateTimeToFileTime

0000 DeleteFileA

0000 CreateFileA

0000 CreateDirectoryA

0000 CompareStringA

0000 CloseHandle

Page 7: International Burmese democratic forces and friends of Burma who

 

 

gdi32.dll

Ordinal Function Name 

 

0000 StretchDIBits

0000 StretchBlt

0000 SetWindowOrgEx

0000 SetTextColor

0000 SetStretchBltMode

0000 SetRectRgn

0000 SetROP2

0000 SetPixel

0000 SetDIBits

0000 SetBrushOrgEx

0000 SetBkMode

0000 SetBkColor

0000 SelectObject

0000 SaveDC

0000 RestoreDC

0000 OffsetRgn

0000 MoveToEx

0000 IntersectClipRect

0000 GetTextExtentPoint32A

0000 GetStockObject

0000 GetPixel

0000 GetObjectA

0000 GetDIBits

Page 8: International Burmese democratic forces and friends of Burma who

0000 ExtSelectClipRgn

0000 ExcludeClipRect

0000 DeleteObject

0000 DeleteDC

0000 CreateSolidBrush

0000 CreateRectRgn

0000 CreateFontIndirectA

0000 CreateDIBSection

0000 CreateCompatibleDC

0000 CreateCompatibleBitmap

0000 CreateBrushIndirect

0000 CombineRgn

0000 BitBlt

0000 AddFontResourceA

 

 

user32.dll

Ordinal Function Name 

 

0000 wvsprintfA

0000 WaitMessage

0000 ValidateRect

0000 TranslateMessage

0000 ShowWindow

0000 SetWindowPos

0000 SetWindowLongA

0000 SetTimer

0000 SetPropA

Page 9: International Burmese democratic forces and friends of Burma who

0000 SetParent

0000 SetForegroundWindow

0000 SetFocus

0000 SetCursor

0000 SendMessageA

0000 ScreenToClient

0000 RemovePropA

0000 ReleaseDC

0000 RegisterClassA

0000 PostQuitMessage

0000 PostMessageA

0000 PeekMessageA

0000 OffsetRect

0000 MessageBoxA

0000 LoadIconA

0000 LoadCursorA

0000 KillTimer

0000 IsZoomed

0000 IsWindowVisible

0000 IsWindowEnabled

0000 IsWindow

0000 IsIconic

0000 InvalidateRect

0000 GetWindowTextLengthA

0000 GetWindowTextA

0000 GetWindowRgn

0000 GetWindowRect

0000 GetWindowLongA

0000 GetWindowDC

Page 10: International Burmese democratic forces and friends of Burma who

0000 GetUpdateRgn

0000 GetSystemMetrics

0000 GetSystemMenu

0000 GetSysColor

0000 GetPropA

0000 GetParent

0000 GetWindow

0000 GetKeyState

0000 GetFocus

0000 GetDCEx

0000 GetDC

0000 GetCursorPos

0000 GetClientRect

0000 GetClassLongA

0000 GetClassInfoA

0000 GetCapture

0000 FindWindowA

0000 FillRect

0000 ExitWindowsEx

0000 EnumWindows

0000 EndPaint

0000 EnableWindow

0000 EnableMenuItem

0000 DrawTextA

0000 DrawIcon

0000 DispatchMessageA

0000 DestroyWindow

0000 DestroyIcon

0000 DeleteMenu

Page 11: International Burmese democratic forces and friends of Burma who

0000 DefWindowProcA

0000 CopyImage

0000 ClientToScreen

0000 CheckRadioButton

0000 CallWindowProcA

0000 BeginPaint

0000 CharLowerBuffA

 

 

winmm.dll

Ordinal Function Name 

 

0000 timeKillEvent

0000 timeSetEvent

 

 

user32.dll

Ordinal Function Name 

 

0000 CreateWindowExA

 

 

oleaut32.dll

Ordinal Function Name 

 

0000 SysAllocStringLen

 

 

Page 12: International Burmese democratic forces and friends of Burma who

ole32.dll

Ordinal Function Name 

 

0000 OleInitialize

 

 

comctl32.dll

Ordinal Function Name 

 

0000 ImageList_Draw

0000 ImageList_SetBkColor

0000 ImageList_Create

0000 InitCommonControls

 

 

shell32.dll

Ordinal Function Name 

 

0000 SHGetFileInfoA

 

 

shell32.dll

Ordinal Function Name 

 

0000 ShellExecuteExA

0000 ShellExecuteA

 

 

Page 13: International Burmese democratic forces and friends of Burma who

cabinet.dll

Ordinal Function Name 

 

0000 FDIDestroy

0000 FDICopy

0000 FDICreate

 

 

ole32.dll

Ordinal Function Name 

 

0000 OleInitialize

0000 CoTaskMemFree

0000 CoCreateInstance

0000 CoUninitialize

0000 CoInitialize

 

 

shell32.dll

Ordinal Function Name 

 

0000 SHGetSpecialFolderLocation

0000 SHGetPathFromIDListA

0000 SHGetMalloc

0000 SHChangeNotify

0000 SHBrowseForFolderA

 

 

Page 14: International Burmese democratic forces and friends of Burma who

Section Table 

Section name: CODE

Virtual Size: 00016e44

Virtual Address: 00001000

Size of raw data: 00017000

Pointer to Raw Data: 00000400

Pointer to Relocations: 00000000

Pointer to Line Numbers: 00000000

Number of Relocations: 0000

Number of Line Numbers: 0000

Characteristics: Section contains code Section is executable Section is readable 

  

 

Section name: DATA

Virtual Size: 00000700

Virtual Address: 00018000

Size of raw data: 00000800

Pointer to Raw Data: 00017400

Pointer to Relocations: 00000000

Pointer to Line Numbers: 00000000

Number of Relocations: 0000

Number of Line Numbers: 0000

Characteristics: Section contains initialized data Section is readable Section is writeable 

  

 

Section name: BSS

Virtual Size: 000008ad

Page 15: International Burmese democratic forces and friends of Burma who

Virtual Address: 00019000

Size of raw data: 00000000

Pointer to Raw Data: 00017c00

Pointer to Relocations: 00000000

Pointer to Line Numbers: 00000000

Number of Relocations: 0000

Number of Line Numbers: 0000

Characteristics: Section is readable Section is writeable 

  

 

Section name: .idata

Virtual Size: 000014d0

Virtual Address: 0001a000

Size of raw data: 00001600

Pointer to Raw Data: 00017c00

Pointer to Relocations: 00000000

Pointer to Line Numbers: 00000000

Number of Relocations: 0000

Number of Line Numbers: 0000

Characteristics: Section contains initialized data Section is readable Section is writeable 

  

 

Section name: .tls

Virtual Size: 00000008

Virtual Address: 0001c000

Size of raw data: 00000000

Pointer to Raw Data: 00019200

Page 16: International Burmese democratic forces and friends of Burma who

Pointer to Relocations: 00000000

Pointer to Line Numbers: 00000000

Number of Relocations: 0000

Number of Line Numbers: 0000

Characteristics: Section is readable Section is writeable 

  

 

Section name: .rdata

Virtual Size: 00000018

Virtual Address: 0001d000

Size of raw data: 00000200

Pointer to Raw Data: 00019200

Pointer to Relocations: 00000000

Pointer to Line Numbers: 00000000

Number of Relocations: 0000

Number of Line Numbers: 0000

Characteristics: Section contains initialized data Section is shareable Section is readable 

  

 

Section name: .reloc

Virtual Size: 000011c4

Virtual Address: 0001e000

Size of raw data: 00001200

Pointer to Raw Data: 00019400

Pointer to Relocations: 00000000

Pointer to Line Numbers: 00000000

Number of Relocations: 0000

Page 17: International Burmese democratic forces and friends of Burma who

Number of Line Numbers: 0000

Characteristics: Section contains initialized data Section is shareable Section is readable 

  

 

Section name: .rsrc

Virtual Size: 000018c8

Virtual Address: 00020000

Size of raw data: 00001a00

Pointer to Raw Data: 0001a600

Pointer to Relocations: 00000000

Pointer to Line Numbers: 00000000

Number of Relocations: 0000

Number of Line Numbers: 0000

Characteristics: Section contains initialized data Section is shareable Section is readable 

  

Header Information 

Signature: 5a4d

Last Page Size: 0050

Total Pages in File: 0002

Relocation Items: 0000

Paragraphs in Header: 0004

Minimum Extra Paragraphs: 000f

Maximum Extra Paragraphs: ffff

Initial Stack Segment: 0000

Initial Stack Pointer: 00b8

Complemented Checksum: 0000

Initial Instruction Pointer: 0000

Page 18: International Burmese democratic forces and friends of Burma who

Initial Code Segment: 0000

Relocation Table Offset: 0040

Overlay Number: 001a

Reserved: 0000 0000 0000 0000

0000 0000 0000 0000

0000 0000 0000 0000

0000 0000 0000 0000

Offset to New Header: 00000100

Memory Needed: 1K