NbtStudio.exe - NbtStudio.dll

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	NbtStudio.exe
size	2862766 (0x2baeae)
md5	9110d7907b13ddce09cb2d02c8f9976f

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
260	30034	12
259	30034	10
261	30034	77
147	30729	16
257	29395	9
1	0	162
265	30140	10
258	30140	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x62cf0990
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.29
SizeOfCode	0x17e00
SizeOfInitializedData	0xd800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x13820
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x2b000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0xc160
SizeOfStackReserve	0x180000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x17dac	0x17e00	R-X CODE
.rdata	0x19000	0x92ca	0x9400	R-- IDATA
.data	0x23000	0x14f8	0xa00	RW- IDATA
.pdata	0x25000	0x1428	0x1600	R-- IDATA
_RDATA	0x27000	0xf4	0x200	R-- IDATA
.rsrc	0x28000	0x1d3c	0x1e00	R-- IDATA
.reloc	0x2a000	0x318	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x2143c	0x104
RESOURCE	0x28000	0x1d3c
EXCEPTION	0x25000	0x1428
SECURITY	0	0
BASERELOC	0x2a000	0x318
DEBUG	0x1dfa0	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x1e180	0x28
LOAD_CONFIG	0x1e000	0x138
Bound_IAT	0	0
IAT	0x19000	0x408
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x14001eff8	0x14001f008	0x1400244e0	0x1400194d0	0	0x400000

show previews

type	name	size	cp
ICON	#1	5812	1252
GROUP_ICON	#32512	20	1252
VERSION	#1	854	1252
MANIFEST	#1	490	1252

module_name	hint	function_name
KERNEL32.dll	414	FindNextFileW
KERNEL32.dll	554	GetCurrentProcess
KERNEL32.dll	651	GetModuleHandleExW
KERNEL32.dll	648	GetModuleFileNameW
KERNEL32.dll	982	LeaveCriticalSection
KERNEL32.dll	892	InitializeCriticalSection
KERNEL32.dll	589	GetEnvironmentVariableW
KERNEL32.dll	391	FindClose
KERNEL32.dll	1032	MultiByteToWideChar
KERNEL32.dll	628	GetLastError
KERNEL32.dll	598	GetFileAttributesExW
KERNEL32.dll	621	GetFullPathNameW
KERNEL32.dll	708	GetProcAddress
KERNEL32.dll	283	DeleteCriticalSection
KERNEL32.dll	1577	WideCharToMultiByte
KERNEL32.dll	938	IsWow64Process
KERNEL32.dll	988	LoadLibraryExW
KERNEL32.dll	445	FreeLibrary
KERNEL32.dll	1481	TlsFree
KERNEL32.dll	1483	TlsSetValue
KERNEL32.dll	1482	TlsGetValue
KERNEL32.dll	1480	TlsAlloc
KERNEL32.dll	321	EnterCriticalSection
KERNEL32.dll	397	FindFirstFileExW
KERNEL32.dll	1072	OutputDebugStringW
KERNEL32.dll	986	LoadLibraryA
KERNEL32.dll	652	GetModuleHandleW
KERNEL32.dll	893	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1367	SetLastError
KERNEL32.dll	1147	RaiseException
KERNEL32.dll	1267	RtlPcToFileHeader
KERNEL32.dll	1271	RtlUnwindEx
KERNEL32.dll	897	InitializeSListHead
KERNEL32.dll	769	GetSystemTimeAsFileTime
KERNEL32.dll	559	GetCurrentThreadId
KERNEL32.dll	555	GetCurrentProcessId
KERNEL32.dll	1124	QueryPerformanceCounter
KERNEL32.dll	919	IsDebuggerPresent
KERNEL32.dll	926	IsProcessorFeaturePresent
KERNEL32.dll	1462	TerminateProcess
KERNEL32.dll	1431	SetUnhandledExceptionFilter
KERNEL32.dll	1496	UnhandledExceptionFilter
KERNEL32.dll	1272	RtlVirtualUnwind
KERNEL32.dll	1265	RtlLookupFunctionEntry
KERNEL32.dll	1257	RtlCaptureContext
KERNEL32.dll	969	LCMapStringEx
KERNEL32.dll	276	DecodePointer
KERNEL32.dll	317	EncodePointer
KERNEL32.dll	894	InitializeCriticalSectionEx
KERNEL32.dll	751	GetStringTypeW
USER32.dll	650	MessageBoxW
SHELL32.dll	432	ShellExecuteW
ADVAPI32.dll	662	RegOpenKeyExW
ADVAPI32.dll	651	RegGetValueW
ADVAPI32.dll	237	DeregisterEventSource
ADVAPI32.dll	696	RegisterEventSourceW
ADVAPI32.dll	714	ReportEventW
ADVAPI32.dll	613	RegCloseKey
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	41	_get_initial_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	57	_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	53	_initialize_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	25	_configure_wide_argv
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	6	__p___wargv
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	33	_errno
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	84	abort
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0.dll	152	setvbuf
api-ms-win-crt-stdio-l1-1-0.dll	119	fflush
api-ms-win-crt-stdio-l1-1-0.dll	98	_wfopen
api-ms-win-crt-stdio-l1-1-0.dll	17	__stdio_common_vswprintf
api-ms-win-crt-stdio-l1-1-0.dll	7	__stdio_common_vfwprintf
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	15	__stdio_common_vsprintf_s
api-ms-win-crt-stdio-l1-1-0.dll		__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll	129	fputwc
api-ms-win-crt-stdio-l1-1-0.dll	130	fputws
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	23	calloc
api-ms-win-crt-string-l1-1-0.dll	169	wcsnlen
api-ms-win-crt-string-l1-1-0.dll	137	strcpy_s
api-ms-win-crt-string-l1-1-0.dll	73	_wcsdup
api-ms-win-crt-string-l1-1-0.dll	138	strcspn
api-ms-win-crt-string-l1-1-0.dll	166	wcsncmp
api-ms-win-crt-string-l1-1-0.dll	152	toupper
api-ms-win-crt-convert-l1-1-0.dll	71	_wtoi
api-ms-win-crt-convert-l1-1-0.dll	115	wcstoul
api-ms-win-crt-locale-l1-1-0.dll	19	setlocale
api-ms-win-crt-locale-l1-1-0.dll	2	___lc_locale_name_func
api-ms-win-crt-locale-l1-1-0.dll	18	localeconv
api-ms-win-crt-locale-l1-1-0.dll	15	_unlock_locales
api-ms-win-crt-locale-l1-1-0.dll	13	_lock_locales
api-ms-win-crt-locale-l1-1-0.dll	3	___mb_cur_max_func
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale
api-ms-win-crt-locale-l1-1-0.dll	6	__pctype_func
api-ms-win-crt-locale-l1-1-0.dll		___lc_codepage_func
api-ms-win-crt-math-l1-1-0.dll	203	frexp
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-time-l1-1-0.dll	32	_gmtime64_s
api-ms-win-crt-time-l1-1-0.dll	48	_time64
api-ms-win-crt-time-l1-1-0.dll	71	wcsftime

StringTable 000004b0

Comments	Views and modifies NBT files
CompanyName	tryashtar
FileDescription	NbtStudio
FileVersion	1.15.3.0
InternalName	NbtStudio.dll
LegalCopyright	Copyright © 2020 tryashtar
OriginalFilename	NbtStudio.dll
ProductName	NBT Studio
ProductVersion	1.15.3
Assembly Version	1.15.3.0

VS_FIXEDFILEINFO

FileVersion	1.15.3.0
ProductVersion	1.15.3.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
23930	5812	PNG	(256 x 256)	#
65b7b	205	PNG	(16 x 16)	#
65c4c	160	PNG	(16 x 16)	#
65cf0	212	PNG	(16 x 16)	#
65dc8	179	PNG	(16 x 16)	#
65e7f	186	PNG	(16 x 16)	#
65f3d	739	PNG	(16 x 16)	#
66224	141	PNG	(16 x 16)	#
662b5	194	PNG	(16 x 16)	#
6637b	170	PNG	(16 x 16)	#
66429	186	PNG	(16 x 16)	#
664e7	175	PNG	(16 x 16)	#
6659a	188	PNG	(16 x 16)	#
6665a	136	PNG	(16 x 16)	#
666e6	170	PNG	(16 x 16)	#
66794	195	PNG	(16 x 16)	#
6685b	182	PNG	(16 x 16)	#
66915	187	PNG	(16 x 16)	#
669d4	174	PNG	(16 x 16)	#
66a86	168	PNG	(16 x 16)	#
66b32	186	PNG	(16 x 16)	#
66bf0	172	PNG	(16 x 16)	#
66ca0	194	PNG	(16 x 16)	#
66d66	144	PNG	(16 x 16)	#
66dfa	154	PNG	(16 x 16)	#
66e98	190	PNG	(16 x 16)	#
66f5a	143	PNG	(16 x 16)	#
66fed	144	PNG	(16 x 16)	#
67081	134	PNG	(16 x 16)	#
6710b	149	PNG	(16 x 16)	#
671a4	145	PNG	(16 x 16)	#
67239	130	PNG	(16 x 16)	#
672bf	144	PNG	(16 x 16)	#
67353	170	PNG	(16 x 16)	#
67401	151	PNG	(16 x 16)	#
674b2	282	PNG	(16 x 16)	#
675e6	5812	PNG	(256 x 256)	#
68c9e	210	PNG	(16 x 16)	#
68d74	401	PNG	(256 x 256)	#
68f09	273	PNG	(16 x 16)	#
6901e	382	PNG	(16 x 16)	#
691a0	362	PNG	(16 x 16)	#
6930e	970	PNG	(16 x 16)	#
696dc	871	PNG	(32 x 32)	#
69a47	1090	PNG	(32 x 32)	#
69e8d	1369	PNG	(32 x 32)	#
6a3ea	764	PNG	(32 x 32)	#
6a6ea	601	PNG	(32 x 32)	#
6a947	737	PNG	(32 x 32)	#
6ac2c	1040	PNG	(32 x 32)	#
6b040	673	PNG	(32 x 32)	#
6b2e5	563	PNG	(32 x 32)	#
6b51c	1016	PNG	(32 x 32)	#
6b918	961	PNG	(32 x 32)	#
6bcdd	675	PNG	(32 x 32)	#
6bf84	606	PNG	(16 x 16)	#
6c1e6	690	PNG	(16 x 16)	#
6c49c	544	PNG	(16 x 16)	#
6c6c0	1529	PNG	(16 x 16)	#
6ccbd	485	PNG	(16 x 16)	#
6cea6	677	PNG	(16 x 16)	#
6d14f	647	PNG	(16 x 16)	#
6d3da	685	PNG	(16 x 16)	#
6d68b	613	PNG	(16 x 16)	#
6d8f4	835	PNG	(16 x 16)	#
6dc3b	265	PNG	(16 x 16)	#
6dd48	507	PNG	(16 x 16)	#
6df47	617	PNG	(16 x 16)	#
6e1b4	700	PNG	(16 x 16)	#
6e474	599	PNG	(16 x 16)	#
6e6cf	631	PNG	(16 x 16)	#
6e94a	438	PNG	(16 x 16)	#
6eb04	690	PNG	(16 x 16)	#
6edba	476	PNG	(16 x 16)	#
6ef9a	630	PNG	(16 x 16)	#
6f214	511	PNG	(16 x 16)	#
6f417	612	PNG	(16 x 16)	#
6f67f	308	PNG	(16 x 16)	#
6f7b7	508	PNG	(16 x 16)	#
6f9b7	593	PNG	(16 x 16)	#
6fc0c	566	PNG	(16 x 16)	#
6fe46	587	PNG	(16 x 16)	#
70095	5913	PNG	(16 x 16)	#
717b2	300	PNG	(16 x 16)	#
718e2	556	PNG	(16 x 16)	#
71b12	5899	PNG	(16 x 16)	#
73221	592	PNG	(16 x 16)	#
73475	305	PNG	(16 x 16)	#
74500	5812	PNG	(256 x 256)	#
788b0	103424	DLL	04/14/2072 10:46:47	#
91cb0	687616	DLL	06/25/2073 03:11:00	#
13b8e0	266752	DLL	05/23/2084 12:15:41	#
17cae0	96768	DLL	05/20/2093 21:50:54	#
1944e0	232960	DLL	03/01/2056 08:43:15	#
1cd2e0	122880	DLL	01/24/2049 09:00:19	#
1eb2e0	376320	DLL	09/07/2063 14:09:17	#
2470e0	99328	DLL	12/16/2049 23:20:22	#
25f4e0	149504	DLL	12/18/2103 17:12:44	#
2801eb	1334	BMP	(16 x 16)	#
280725	822	BMP	(16 x 16)	#
280a5f	1334	BMP	(16 x 16)	#
280f99	574	BMP	(13 x 13)	#
2811dc	6979	GIF	(16 x 16)	#
282d23	306	BMP	(9 x 9)	#
282e59	306	BMP	(9 x 9)	#
282f8f	574	BMP	(13 x 13)	#
2831d1	574	BMP	(13 x 13)	#
283ce0	72704	DLL	09/24/2086 11:03:41	#
2958e0	94208	DLL	03/23/2054 21:23:28	#
2ac8e0	10752	DLL	02/11/2077 09:13:01	#
2af2e0	22528	DLL	11/07/2065 01:11:13	#
2b4ae0	24576	DLL	04/05/2063 13:41:23	#
2baae0	974	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 2862766 bytes (2796 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x244e0

NbtStudio.exe- NbtStudio.dll - NbtStudio

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 000004b0

VS_FIXEDFILEINFO

NbtStudio.exe
- NbtStudio.dll - NbtStudio