cs_playground.exe - cs_playground.dll

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	cs_playground.exe
size	153600 (0x25800)
md5	017e65f0321927942956dbe7f2e6d8e1

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
260	31616	12
259	31616	10
261	31616	80
147	30729	16
257	30795	9
1	0	165
265	31630	10
258	31630	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x6377ba57
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.33
SizeOfCode	0x18c00
SizeOfInitializedData	0xc800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x14360
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x2b000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0xc160
SizeOfStackReserve	0x180000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig4

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x18bdc	0x18c00	R-X CODE
.rdata	0x1a000	0x9b5a	0x9c00	R-- IDATA
.data	0x24000	0x1568	0xa00	RW- IDATA
.pdata	0x26000	0x1524	0x1600	R-- IDATA
_RDATA	0x28000	0x15c	0x200	R-- IDATA
.rsrc	0x29000	0x574	0x600	R-- IDATA
.reloc	0x2a000	0x344	0x400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x22ca4	0x104
RESOURCE	0x29000	0x574
EXCEPTION	0x26000	0x1524
SECURITY	0	0
BASERELOC	0x2a000	0x344
DEBUG	0x1f490	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x1f500	0x28
LOAD_CONFIG	0x1f350	0x140
Bound_IAT	0	0
IAT	0x1a000	0x410
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x1400206c0	0x1400206d0	0x140025550	0x14001a4e8	0	0x400000

show previews

type	name	size	cp
VERSION	#1	744	1252
MANIFEST	#1	490	1252

module_name	hint	function_name
KERNEL32.dll	422	FindNextFileW
KERNEL32.dll	562	GetCurrentProcess
KERNEL32.dll	660	GetModuleHandleExW
KERNEL32.dll	657	GetModuleFileNameW
KERNEL32.dll	992	LeaveCriticalSection
KERNEL32.dll	901	InitializeCriticalSection
KERNEL32.dll	597	GetEnvironmentVariableW
KERNEL32.dll	399	FindClose
KERNEL32.dll	1042	MultiByteToWideChar
KERNEL32.dll	637	GetLastError
KERNEL32.dll	606	GetFileAttributesExW
KERNEL32.dll	629	GetFullPathNameW
KERNEL32.dll	717	GetProcAddress
KERNEL32.dll	291	DeleteCriticalSection
KERNEL32.dll	1591	WideCharToMultiByte
KERNEL32.dll	948	IsWow64Process
KERNEL32.dll	998	LoadLibraryExW
KERNEL32.dll	453	FreeLibrary
KERNEL32.dll	1495	TlsFree
KERNEL32.dll	1497	TlsSetValue
KERNEL32.dll	1496	TlsGetValue
KERNEL32.dll	1494	TlsAlloc
KERNEL32.dll	329	EnterCriticalSection
KERNEL32.dll	405	FindFirstFileExW
KERNEL32.dll	1082	OutputDebugStringW
KERNEL32.dll	996	LoadLibraryA
KERNEL32.dll	661	GetModuleHandleW
KERNEL32.dll	902	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1380	SetLastError
KERNEL32.dll	1159	RaiseException
KERNEL32.dll	1279	RtlPcToFileHeader
KERNEL32.dll	1283	RtlUnwindEx
KERNEL32.dll	906	InitializeSListHead
KERNEL32.dll	778	GetSystemTimeAsFileTime
KERNEL32.dll	567	GetCurrentThreadId
KERNEL32.dll	563	GetCurrentProcessId
KERNEL32.dll	1136	QueryPerformanceCounter
KERNEL32.dll	928	IsDebuggerPresent
KERNEL32.dll	936	IsProcessorFeaturePresent
KERNEL32.dll	1476	TerminateProcess
KERNEL32.dll	1444	SetUnhandledExceptionFilter
KERNEL32.dll	1510	UnhandledExceptionFilter
KERNEL32.dll	1284	RtlVirtualUnwind
KERNEL32.dll	1277	RtlLookupFunctionEntry
KERNEL32.dll	1269	RtlCaptureContext
KERNEL32.dll	979	LCMapStringEx
KERNEL32.dll	284	DecodePointer
KERNEL32.dll	325	EncodePointer
KERNEL32.dll	903	InitializeCriticalSectionEx
KERNEL32.dll	760	GetStringTypeW
USER32.dll	651	MessageBoxW
SHELL32.dll	432	ShellExecuteW
ADVAPI32.dll	642	RegOpenKeyExW
ADVAPI32.dll	631	RegGetValueW
ADVAPI32.dll	237	DeregisterEventSource
ADVAPI32.dll	676	RegisterEventSourceW
ADVAPI32.dll	694	ReportEventW
ADVAPI32.dll	593	RegCloseKey
api-ms-win-crt-runtime-l1-1-0.dll	57	_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	6	__p___wargv
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	33	_errno
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	53	_initialize_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	25	_configure_wide_argv
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	41	_get_initial_wide_environment
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-runtime-l1-1-0.dll	84	abort
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0.dll	7	__stdio_common_vfwprintf
api-ms-win-crt-stdio-l1-1-0.dll	15	__stdio_common_vsprintf_s
api-ms-win-crt-stdio-l1-1-0.dll	152	setvbuf
api-ms-win-crt-stdio-l1-1-0.dll	17	__stdio_common_vswprintf
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll		__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll	129	fputwc
api-ms-win-crt-stdio-l1-1-0.dll	130	fputws
api-ms-win-crt-stdio-l1-1-0.dll	12	__stdio_common_vsnwprintf_s
api-ms-win-crt-stdio-l1-1-0.dll	102	_wfsopen
api-ms-win-crt-stdio-l1-1-0.dll	119	fflush
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll	8	_callnewh
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	23	calloc
api-ms-win-crt-string-l1-1-0.dll	169	wcsnlen
api-ms-win-crt-string-l1-1-0.dll	137	strcpy_s
api-ms-win-crt-string-l1-1-0.dll	73	_wcsdup
api-ms-win-crt-string-l1-1-0.dll	138	strcspn
api-ms-win-crt-string-l1-1-0.dll	166	wcsncmp
api-ms-win-crt-string-l1-1-0.dll	152	toupper
api-ms-win-crt-convert-l1-1-0.dll	115	wcstoul
api-ms-win-crt-convert-l1-1-0.dll	71	_wtoi
api-ms-win-crt-locale-l1-1-0.dll	6	__pctype_func
api-ms-win-crt-locale-l1-1-0.dll	15	_unlock_locales
api-ms-win-crt-locale-l1-1-0.dll	13	_lock_locales
api-ms-win-crt-locale-l1-1-0.dll	2	___lc_locale_name_func
api-ms-win-crt-locale-l1-1-0.dll		___lc_codepage_func
api-ms-win-crt-locale-l1-1-0.dll	3	___mb_cur_max_func
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale
api-ms-win-crt-locale-l1-1-0.dll	19	setlocale
api-ms-win-crt-locale-l1-1-0.dll	18	localeconv
api-ms-win-crt-math-l1-1-0.dll	203	frexp
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-time-l1-1-0.dll	32	_gmtime64_s
api-ms-win-crt-time-l1-1-0.dll	71	wcsftime
api-ms-win-crt-time-l1-1-0.dll	48	_time64

StringTable 000004b0

CompanyName	cs_playground
FileDescription	cs_playground
FileVersion	1.0.0.0
InternalName	cs_playground.dll
LegalCopyright
OriginalFilename	cs_playground.dll
ProductName	cs_playground
ProductVersion	1.0.0
Assembly Version	1.0.0.0

VS_FIXEDFILEINFO

FileVersion	1.0.0.0
ProductVersion	1.0.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	148016	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x25550

cs_playground.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

TLS

StringTable 000004b0

VS_FIXEDFILEINFO

cs_playground.exe
-