../windows/k.exe (hex) (dec) .EXE size (bytes) 490 1168 Minimum load size (bytes) 450 1104 Overlay number 0 0 Initial CS:IP 0000:0000 Initial SS:SP 0000:00B8 184 Minimum allocation (para) 0 0 Maximum allocation (para) FFFF 65535 Header size (para) 4 4 Relocation table offset 40 64 Relocation entries 0 0 Portable Executable starts at 80 Signature 00004550 (PE) Machine 014C (Intel 386) Sections 0004 Time Date Stamp 3F3BB571 Thu Aug 14 17:14:41 2003 Symbol Table 00000000 Number of Symbols 00000000 Optional header size 00E0 Characteristics 012F Relocation information stripped Executable Image Line numbers stripped Local symbols stripped Large Address aware (>2GB) 32 bit word machine Magic 010B Linker Version 5.00 Size of Code 00000200 Size of Initialized Data 00000600 Size of Uninitialized Data 00000000 Address of Entry Point 00001020 Base of Code 00001000 Base of Data 00002000 Image Base 00400000 Section Alignment 00001000 File Alignment 00000200 Operating System Version 4.00 Image Version 0.00 Subsystem Version 4.00 reserved 00000000 Image Size 00005000 Header Size 00000400 Checksum 00009E0A Subsystem 0003 (Console) DLL Characteristics 0000 Size Of Stack Reserve 00100000 Size Of Stack Commit 00001000 Size Of Heap Reserve 00100000 Size Of Heap Commit 00001000 Loader Flags 00000000 Number of Directories 00000010 Directory Name VirtAddr VirtSize -------------------------------------- -------- -------- Export 00000000 00000000 Import 00004000 0000003C Resource 00000000 00000000 Exception 00000000 00000000 Security 00000000 00000000 Base Relocation 00000000 00000000 Debug 00000000 00000000 Decription/Architecture 00000000 00000000 Machine Value (MIPS GP) 00000000 00000000 Thread Storage 00000000 00000000 Load Configuration 00000000 00000000 Bound Import 00000000 00000000 Import Address Table 0000407C 00000040 Delay Import 00000000 00000000 COM Runtime Descriptor 00000000 00000000 (reserved) 00000000 00000000 Section Table ------------- 01 .text Virtual Address 00001000 Virtual Size 000001CC Raw Data Offset 00000400 Raw Data Size 00000200 Relocation Offset 00000000 Relocation Count 0000 Line Number Offset 00000000 Line Number Count 0000 Characteristics 60000020 Code Executable Readable 02 .rdata Virtual Address 00002000 Virtual Size 0000000C Raw Data Offset 00000600 Raw Data Size 00000200 Relocation Offset 00000000 Relocation Count 0000 Line Number Offset 00000000 Line Number Count 0000 Characteristics 40000040 Initialized Data Readable 03 .data Virtual Address 00003000 Virtual Size 00000040 Raw Data Offset 00000800 Raw Data Size 00000200 Relocation Offset 00000000 Relocation Count 0000 Line Number Offset 00000000 Line Number Count 0000 Characteristics C0000040 Initialized Data Readable Writeable 04 .idata Virtual Address 00004000 Virtual Size 00000198 Raw Data Offset 00000A00 Raw Data Size 00000200 Relocation Offset 00000000 Relocation Count 0000 Line Number Offset 00000000 Line Number Count 0000 Characteristics C0000040 Initialized Data Readable Writeable Imp Addr Hint Import Name from k20.dll - Not Bound -------- ---- --------------------------------------------------------------- 000040B4 1C kmain Imp Addr Hint Import Name from MSVCRT.dll - Not Bound -------- ---- --------------------------------------------------------------- 0000407C 9A _adjust_fdiv 00004080 81 __setusermatherr 00004084 CF _exit 00004088 48 _XcptFilter 0000408C 244 exit 00004090 63 __p___initenv 00004094 58 __getmainargs 00004098 10B _initterm 0000409C 69 __p__commode 000040A0 6E __p__fmode 000040A4 7F __set_app_type 000040A8 C6 _except_handler3 000040AC B3 _controlfp IAT Entry 00000000: 0000412A 00004116 - 000040CC 000040D4 - 000040E2 000040EA 00000018: 000040FA 0000410A - 0000413A 0000414A - 00004158 0000416A 00000030: 0000418A 00000000 - 000040BC 00000000 Disassembly 00401000 fn_00401000: ; Xref 0040111A 00401000 FF742408 push dword ptr [esp+8] 00401004 FF742408 push dword ptr [esp+8] 00401008 6820304000 push 403020h 0040100D E804000000 call jmp_kmain 00401012 83C40C add esp,0Ch 00401015 C3 ret 00401016 jmp_kmain: ; Xref 0040100D 00401016 FF25B4404000 jmp dword ptr [kmain] 0040101C CC int 3 0040101D CC int 3 0040101E CC int 3 0040101F CC int 3 00401020 start: 00401020 55 push ebp 00401021 8BEC mov ebp,esp 00401023 6AFF push 0FFFFFFFFh 00401025 6800204000 push 402000h 0040102A 68C0114000 push 4011C0h 0040102F 64A100000000 mov eax,fs:[0] 00401035 50 push eax 00401036 64892500000000 mov fs:[0],esp 0040103D 83C4E0 add esp,0FFFFFFE0h 00401040 53 push ebx 00401041 56 push esi 00401042 57 push edi 00401043 8965E8 mov [ebp-18h],esp 00401046 C745FC00000000 mov dword ptr [ebp-4],0 0040104D 6A01 push 1 0040104F FF15A4404000 call dword ptr [__set_app_type] 00401055 83C404 add esp,4 00401058 C70534304000FFFFFFFF mov dword ptr [403034h],0FFFFFFFFh 00401062 C70538304000FFFFFFFF mov dword ptr [403038h],0FFFFFFFFh 0040106C FF15A0404000 call dword ptr [__p__fmode] 00401072 8B0D30304000 mov ecx,[403030h] 00401078 8908 mov [eax],ecx 0040107A FF159C404000 call dword ptr [__p__commode] 00401080 8B152C304000 mov edx,[40302Ch] 00401086 8910 mov [eax],edx 00401088 A17C404000 mov eax,[_adjust_fdiv] 0040108D 8B08 mov ecx,[eax] 0040108F 890D3C304000 mov [40303Ch],ecx 00401095 E816010000 call fn_004011B0 0040109A A110304000 mov eax,[403010h] 0040109F 85C0 test eax,eax 004010A1 750E jnz loc_004010B1 004010A3 68A0114000 push 4011A0h 004010A8 FF1580404000 call dword ptr [__setusermatherr] 004010AE 83C404 add esp,4 004010B1 loc_004010B1: ; Xref 004010A1 004010B1 E8CA000000 call fn_00401180 004010B6 680C304000 push 40300Ch 004010BB 6808304000 push 403008h 004010C0 E8B1000000 call jmp__initterm 004010C5 83C408 add esp,8 004010C8 8B1528304000 mov edx,[403028h] 004010CE 8955D8 mov [ebp-28h],edx 004010D1 8D45D8 lea eax,[ebp-28h] 004010D4 50 push eax 004010D5 8B0D24304000 mov ecx,[403024h] 004010DB 51 push ecx 004010DC 8D55E0 lea edx,[ebp-20h] 004010DF 52 push edx 004010E0 8D45D4 lea eax,[ebp-2Ch] 004010E3 50 push eax 004010E4 8D4DE4 lea ecx,[ebp-1Ch] 004010E7 51 push ecx 004010E8 FF1594404000 call dword ptr [__getmainargs] 004010EE 83C414 add esp,14h 004010F1 6804304000 push 403004h 004010F6 6800304000 push 403000h 004010FB E876000000 call jmp__initterm 00401100 83C408 add esp,8 00401103 FF1590404000 call dword ptr [__p___initenv] 00401109 8B55E0 mov edx,[ebp-20h] 0040110C 8910 mov [eax],edx 0040110E 8B45E0 mov eax,[ebp-20h] 00401111 50 push eax 00401112 8B4DD4 mov ecx,[ebp-2Ch] 00401115 51 push ecx 00401116 8B55E4 mov edx,[ebp-1Ch] 00401119 52 push edx 0040111A E8E1FEFFFF call fn_00401000 0040111F 83C40C add esp,0Ch 00401122 8945DC mov [ebp-24h],eax 00401125 50 push eax 00401126 FF158C404000 call dword ptr [exit] 0040112C EB22 jmp loc_00401150 0040112E 8B45EC mov eax,[ebp-14h] 00401131 8B08 mov ecx,[eax] 00401133 8B09 mov ecx,[ecx] 00401135 894DD0 mov [ebp-30h],ecx 00401138 50 push eax 00401139 51 push ecx 0040113A E831000000 call jmp__XcptFilter 0040113F 83C408 add esp,8 00401142 C3 ret 00401143 8B65E8 mov esp,[ebp-18h] 00401146 8B55D0 mov edx,[ebp-30h] 00401149 52 push edx 0040114A FF1584404000 call dword ptr [_exit] 00401150 loc_00401150: ; Xref 0040112C 00401150 83C404 add esp,4 00401153 C745FCFFFFFFFF mov dword ptr [ebp-4],0FFFFFFFFh 0040115A 8B4DF0 mov ecx,[ebp-10h] 0040115D 64890D00000000 mov fs:[0],ecx 00401164 5F pop edi 00401165 5E pop esi 00401166 5B pop ebx 00401167 8BE5 mov esp,ebp 00401169 5D pop ebp 0040116A C3 ret 0040116B 90 nop 0040116C 90 nop 0040116D 90 nop 0040116E 90 nop 0040116F 90 nop 00401170 jmp__XcptFilter: ; Xref 0040113A 00401170 FF2588404000 jmp dword ptr [_XcptFilter] 00401176 jmp__initterm: ; Xref 004010C0 004010FB 00401176 FF2598404000 jmp dword ptr [_initterm] 0040117C CC int 3 0040117D CC int 3 0040117E CC int 3 0040117F CC int 3 00401180 fn_00401180: ; Xref 004010B1 00401180 6800000300 push 30000h 00401185 6800000100 push 10000h 0040118A E837000000 call jmp__controlfp 0040118F 83C408 add esp,8 00401192 C3 ret 00401193 90 nop 00401194 90 nop 00401195 90 nop 00401196 90 nop 00401197 90 nop 00401198 90 nop 00401199 90 nop 0040119A 90 nop 0040119B 90 nop 0040119C 90 nop 0040119D 90 nop 0040119E 90 nop 0040119F 90 nop 004011A0 33C0 xor eax,eax 004011A2 C3 ret 004011A3 90 nop 004011A4 90 nop 004011A5 90 nop 004011A6 90 nop 004011A7 90 nop 004011A8 90 nop 004011A9 90 nop 004011AA 90 nop 004011AB 90 nop 004011AC 90 nop 004011AD 90 nop 004011AE 90 nop 004011AF 90 nop 004011B0 fn_004011B0: ; Xref 00401095 004011B0 C3 ret 004011B1 90 nop 004011B2 90 nop 004011B3 90 nop 004011B4 90 nop 004011B5 90 nop 004011B6 90 nop 004011B7 90 nop 004011B8 90 nop 004011B9 90 nop 004011BA 90 nop 004011BB 90 nop 004011BC 90 nop 004011BD 90 nop 004011BE 90 nop 004011BF 90 nop 004011C0 FF25A8404000 jmp dword ptr [_except_handler3] 004011C6 jmp__controlfp: ; Xref 0040118A 004011C6 FF25AC404000 jmp dword ptr [_controlfp] 00402000 FF FF FF FF 2E 11 40 00 - 43 11 40 00 ......@.C.@. 00403000 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00403010 01 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00403020 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00403030 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00404000 74 40 00 00 00 00 00 00 - 00 00 00 00 C4 40 00 00 t@...........@.. 00404010 B4 40 00 00 3C 40 00 00 - 00 00 00 00 00 00 00 00 .@..<@.......... 00404020 7E 41 00 00 7C 40 00 00 - 00 00 00 00 00 00 00 00 ~A..|@.......... 00404030 00 00 00 00 00 00 00 00 - 00 00 00 00 ............ 0040403C 2A410000 dd 0000412Ah 00404040 16410000 dd 00004116h 00404044 CC400000 dd 000040CCh 00404048 D4400000 dd 000040D4h 0040404C E2400000 dd 000040E2h 00404050 EA400000 dd 000040EAh 00404054 FA400000 dd 000040FAh 00404058 0A410000 dd 0000410Ah 0040405C 3A410000 dd 0000413Ah 00404060 4A410000 dd 0000414Ah 00404064 58410000 dd 00004158h 00404068 6A410000 dd 0000416Ah 0040406C 8A410000 dd 0000418Ah 00404070 00 00 00 00 .... 00404074 BC400000 dd 000040BCh 00404078 00 00 00 00 .... 0040407C _adjust_fdiv: 0040407C 2A410000 dd 0000412Ah 00404080 __setusermatherr: 00404080 16410000 dd 00004116h 00404084 _exit: 00404084 CC400000 dd 000040CCh 00404088 _XcptFilter: 00404088 D4400000 dd 000040D4h 0040408C exit: 0040408C E2400000 dd 000040E2h 00404090 __p___initenv: 00404090 EA400000 dd 000040EAh 00404094 __getmainargs: 00404094 FA400000 dd 000040FAh 00404098 _initterm: 00404098 0A410000 dd 0000410Ah 0040409C __p__commode: 0040409C 3A410000 dd 0000413Ah 004040A0 __p__fmode: 004040A0 4A410000 dd 0000414Ah 004040A4 __set_app_type: 004040A4 58410000 dd 00004158h 004040A8 _except_handler3: 004040A8 6A410000 dd 0000416Ah 004040AC _controlfp: 004040AC 8A410000 dd 0000418Ah 004040B0 00 00 00 00 .... 004040B4 kmain: 004040B4 BC400000 dd 000040BCh 004040B8 00 00 00 00 1C 00 6B 6D - 61 69 6E 00 6B 32 30 2E ......kmain.k20. 004040C8 64 6C 6C 00 CF 00 5F 65 - 78 69 74 00 48 00 5F 58 dll..._exit.H._X 004040D8 63 70 74 46 69 6C 74 65 - 72 00 44 02 65 78 69 74 cptFilter.D.exit 004040E8 00 00 63 00 5F 5F 70 5F - 5F 5F 69 6E 69 74 65 6E ..c.__p___initen 004040F8 76 00 58 00 5F 5F 67 65 - 74 6D 61 69 6E 61 72 67 v.X.__getmainarg 00404108 73 00 0B 01 5F 69 6E 69 - 74 74 65 72 6D 00 81 00 s..._initterm... 00404118 5F 5F 73 65 74 75 73 65 - 72 6D 61 74 68 65 72 72 __setusermatherr 00404128 00 00 9A 00 5F 61 64 6A - 75 73 74 5F 66 64 69 76 ...._adjust_fdiv 00404138 00 00 69 00 5F 5F 70 5F - 5F 63 6F 6D 6D 6F 64 65 ..i.__p__commode 00404148 00 00 6E 00 5F 5F 70 5F - 5F 66 6D 6F 64 65 00 00 ..n.__p__fmode.. 00404158 7F 00 5F 5F 73 65 74 5F - 61 70 70 5F 74 79 70 65 ..__set_app_type 00404168 00 00 C6 00 5F 65 78 63 - 65 70 74 5F 68 61 6E 64 ...._except_hand 00404178 6C 65 72 33 00 00 4D 53 - 56 43 52 54 2E 64 6C 6C ler3..MSVCRT.dll 00404188 00 00 B3 00 5F 63 6F 6E - 74 72 6F 6C 66 70 00 00 ...._controlfp..