objdump -x -D bfab4d3c076ac4059f3c1e680c7a6933.exe

bfab4d3c076ac4059f3c1e680c7a6933.exe:     file format pei-i386
bfab4d3c076ac4059f3c1e680c7a6933.exe
architecture: i386, flags 0x0000012e:
EXEC_P, HAS_LINENO, HAS_DEBUG, HAS_LOCALS, D_PAGED
start address 0x00401020

Characteristics 0x103
	relocations stripped
	executable
	32 bit words

Time/Date		Sun Feb  3 18:13:25 2008
Magic			010b	(PE32)
MajorLinkerVersion	8
MinorLinkerVersion	0
SizeOfCode		00000200
SizeOfInitializedData	00000200
SizeOfUninitializedData	00000000
AddressOfEntryPoint	00001020
BaseOfCode		00001000
BaseOfData		00002000
ImageBase		00400000
SectionAlignment	00001000
FileAlignment		00000200
MajorOSystemVersion	4
MinorOSystemVersion	0
MajorImageVersion	0
MinorImageVersion	0
MajorSubsystemVersion	4
MinorSubsystemVersion	0
Win32Version		00000000
SizeOfImage		00003000
SizeOfHeaders		00000200
CheckSum		00000000
Subsystem		00000002	(Windows GUI)
DllCharacteristics	00000400
SizeOfStackReserve	00100000
SizeOfStackCommit	00001000
SizeOfHeapReserve	00100000
SizeOfHeapCommit	00001000
LoaderFlags		00000000
NumberOfRvaAndSizes	00000010

The Data Directory
Entry 0 00000000 00000000 Export Directory [.edata (or where ever we found it)]
Entry 1 00000000 00000000 Import Directory [parts of .idata]
Entry 2 00000000 00000000 Resource Directory [.rsrc]
Entry 3 00000000 00000000 Exception Directory [.pdata]
Entry 4 00000000 00000000 Security Directory
Entry 5 00000000 00000000 Base Relocation Directory [.reloc]
Entry 6 00000000 00000000 Debug Directory
Entry 7 00000000 00000000 Description Directory
Entry 8 00000000 00000000 Special Directory
Entry 9 00000000 00000000 Thread Storage Directory [.tls]
Entry a 00000000 00000000 Load Configuration Directory
Entry b 00000000 00000000 Bound Import Directory
Entry c 00000000 00000000 Import Address Table Directory
Entry d 00000000 00000000 Delay Import Directory
Entry e 00000000 00000000 CLR Runtime Header
Entry f 00000000 00000000 Reserved

Sections:
Idx Name          Size      VMA               LMA               File off  Algn
  0 .text         00000041  00401000  00401000  00000200  2**2
                  CONTENTS, ALLOC, LOAD, READONLY, CODE
  1 .data         0000004b  00402000  00402000  00000400  2**2
                  CONTENTS, ALLOC, LOAD, DATA
SYMBOL TABLE:
no symbols

Disassembly of section .text:

00401000 <.text>:
  401000:	55                   	push   %ebp
  401001:	8b ec                	mov    %esp,%ebp
  401003:	51                   	push   %ecx
  401004:	c7 45 fc ee ff c0 00 	movl   $0xc0ffee,-0x4(%ebp)
  40100b:	8b 45 fc             	mov    -0x4(%ebp),%eax
  40100e:	35 00 10 40 00       	xor    $0x401000,%eax
  401013:	35 ee 44 87 00       	xor    $0x8744ee,%eax
  401018:	8b e5                	mov    %ebp,%esp
  40101a:	5d                   	pop    %ebp
  40101b:	c3                   	ret    
  40101c:	cc                   	int3   
  40101d:	cc                   	int3   
  40101e:	cc                   	int3   
  40101f:	cc                   	int3   
  401020:	55                   	push   %ebp
  401021:	8b ec                	mov    %esp,%ebp
  401023:	51                   	push   %ecx
  401024:	c7 45 fc 00 00 00 00 	movl   $0x0,-0x4(%ebp)
  40102b:	68 00 20 40 00       	push   $0x402000
  401030:	e8 cb ff ff ff       	call   0x401000
  401035:	83 c4 04             	add    $0x4,%esp
  401038:	89 45 fc             	mov    %eax,-0x4(%ebp)
  40103b:	33 c0                	xor    %eax,%eax
  40103d:	8b e5                	mov    %ebp,%esp
  40103f:	5d                   	pop    %ebp
  401040:	c3                   	ret    

Disassembly of section .data:

00402000 <.data>:
  402000:	45                   	inc    %ebp
  402001:	6d                   	insl   (%dx),%es:(%edi)
  402002:	61                   	popa   
  402003:	69 6c 20 69 73 20 72 	imul   $0x65722073,0x69(%eax,%eiz,1),%ebp
  40200a:	65 
  40200b:	74 75                	je     0x402082
  40200d:	72 6e                	jb     0x40207d
  40200f:	20 76 61             	and    %dh,0x61(%esi)
  402012:	6c                   	insb   (%dx),%es:(%edi)
  402013:	75 65                	jne    0x40207a
  402015:	20 6f 66             	and    %ch,0x66(%edi)
  402018:	20 66 6e             	and    %ah,0x6e(%esi)
  40201b:	20 69 6e             	and    %ch,0x6e(%ecx)
  40201e:	20 66 6f             	and    %ah,0x6f(%esi)
  402021:	72 6d                	jb     0x402090
  402023:	20 30                	and    %dh,(%eax)
  402025:	78 31                	js     0x402058
  402027:	32 33                	xor    (%ebx),%dh
  402029:	34 35                	xor    $0x35,%al
  40202b:	36                   	ss
  40202c:	37                   	aaa    
  40202d:	38 20                	cmp    %ah,(%eax)
  40202f:	7a 65                	jp     0x402096
  402031:	72 6f                	jb     0x4020a2
  402033:	20 70 61             	and    %dh,0x61(%eax)
  402036:	64 64 65 64 20 74 6f 	and    %dh,%fs:%gs:0x20(%edi,%ebp,2)
  40203d:	20 
  40203e:	65 69 67 68 74 20 64 	imul   $0x69642074,%gs:0x68(%edi),%esp
  402045:	69 
  402046:	67                   	addr16
  402047:	69                   	.byte 0x69
  402048:	74 73                	je     0x4020bd
	...