filenameflopgen.exe
size17658856 (0x10d73e8)
md5019224762b08eb3daa0c262aa262e6e6
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections0x10
TimeDateStamp0x5f78a4fb
PointerToSymbolTable0xe48e00
NumberOfSymbols0xb25e
SizeOfOptionalHeader0xe0
Characteristics0x107
Magic0x10b
LinkerVersion2.35
SizeOfCode0x11cc00
SizeOfInitializedData0x219600
SizeOfUninitializedData0x1200
AddressOfEntryPoint0x14c0
BaseOfCode0x1000
BaseOfData0x11e000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion1.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xe52000
SizeOfHeaders0x400
CheckSum0x10d7ff6
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x11cb100x11cc00R-X CODE IDATA
.data0x11e0000x1bd40x1c00RW- IDATA
.rdata0x1200000x85e340x86000R-- IDATA
/40x1a60000x735a80x73600R-- IDATA
.bss0x21a0000x11a40RW- UDATA
.idata0x21c0000x13480x1400RW- IDATA
.CRT0x21e0000x380x200RW- IDATA
.tls0x21f00080x200RW- IDATA
/140x2200000x94780x9600R-- IDATA DISCARDABLE
/290x22a0000x7088f10x708a00R-- IDATA DISCARDABLE
/410x9330000x3ccb80x3ce00R-- IDATA DISCARDABLE
/550x9700000x139de30x139e00R-- IDATA DISCARDABLE
/670xaaa0000x380x200R-- IDATA DISCARDABLE
/800xaab0000x16bd80x16c00R-- IDATA DISCARDABLE
/910xac20000x2d3feb0x2d4000R-- IDATA DISCARDABLE
/1020xd960000xbb9e00xbba00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x21c0000x1348
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x19bccc0x18
LOAD_CONFIG00
Bound_IAT00
IAT0x21c3180x2dc
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x61f0000x61f0040x61a6100x61e02000
module_namehintordfunction_name
KERNEL32.dll21AddVectoredExceptionHandler
KERNEL32.dll136CloseHandle
KERNEL32.dll192CreateEventA
KERNEL32.dll207CreateFileW
KERNEL32.dll211CreateHardLinkW
KERNEL32.dll237CreateSemaphoreA
KERNEL32.dll277DeleteCriticalSection
KERNEL32.dll282DeleteFileW
KERNEL32.dll304DuplicateHandle
KERNEL32.dll310EnterCriticalSection
KERNEL32.dll396FindFirstVolumeW
KERNEL32.dll407FindNextVolumeW
KERNEL32.dll414FindVolumeClose
KERNEL32.dll433FreeLibrary
KERNEL32.dll543GetCurrentProcess
KERNEL32.dll544GetCurrentProcessId
KERNEL32.dll547GetCurrentThread
KERNEL32.dll548GetCurrentThreadId
KERNEL32.dll560GetDiskFreeSpaceExW
KERNEL32.dll589GetFileAttributesW
KERNEL32.dll591GetFileInformationByHandle
KERNEL32.dll596GetFileSizeEx
KERNEL32.dll598GetFileType
KERNEL32.dll609GetFullPathNameW
KERNEL32.dll614GetHandleInformation
KERNEL32.dll617GetLastError
KERNEL32.dll637GetModuleHandleA
KERNEL32.dll640GetModuleHandleW
KERNEL32.dll694GetProcAddress
KERNEL32.dll695GetProcessAffinityMask
KERNEL32.dll729GetStartupInfoA
KERNEL32.dll755GetSystemTimeAsFileTime
KERNEL32.dll768GetTempPathW
KERNEL32.dll769GetThreadContext
KERNEL32.dll779GetThreadPriority
KERNEL32.dll786GetTickCount
KERNEL32.dll808GetVolumeInformationW
KERNEL32.dll877InitializeCriticalSection
KERNEL32.dll909IsDBCSLeadByteEx
KERNEL32.dll910IsDebuggerPresent
KERNEL32.dll973LeaveCriticalSection
KERNEL32.dll977LoadLibraryA
KERNEL32.dll980LoadLibraryW
KERNEL32.dll1024MultiByteToWideChar
KERNEL32.dll1055OpenProcess
KERNEL32.dll1065OutputDebugStringA
KERNEL32.dll1118QueryPerformanceCounter
KERNEL32.dll1119QueryPerformanceFrequency
KERNEL32.dll1140RaiseException
KERNEL32.dll1182ReleaseSemaphore
KERNEL32.dll1187RemoveDirectoryW
KERNEL32.dll1193RemoveVectoredExceptionHandler
KERNEL32.dll1200ResetEvent
KERNEL32.dll1207ResumeThread
KERNEL32.dll1276SetEndOfFile
KERNEL32.dll1282SetEvent
KERNEL32.dll1294SetFilePointer
KERNEL32.dll1310SetLastError
KERNEL32.dll1321SetProcessAffinityMask
KERNEL32.dll1345SetThreadContext
KERNEL32.dll1355SetThreadPriority
KERNEL32.dll1370SetUnhandledExceptionFilter
KERNEL32.dll1386Sleep
KERNEL32.dll1394SuspendThread
KERNEL32.dll1401TerminateProcess
KERNEL32.dll1419TlsAlloc
KERNEL32.dll1421TlsGetValue
KERNEL32.dll1422TlsSetValue
KERNEL32.dll1429TryEnterCriticalSection
KERNEL32.dll1435UnhandledExceptionFilter
KERNEL32.dll1469VirtualProtect
KERNEL32.dll1472VirtualQuery
KERNEL32.dll1479WaitForMultipleObjects
KERNEL32.dll1481WaitForSingleObject
KERNEL32.dll1522WideCharToMultiByte
msvcrt.dll56__doserrno
msvcrt.dll58__getmainargs
msvcrt.dll59__initenv
msvcrt.dll68__lconv_init
msvcrt.dll69__mb_cur_max
msvcrt.dll76__p__acmdln
msvcrt.dll83__p__fmode
msvcrt.dll104__set_app_type
msvcrt.dll107__setusermatherr
msvcrt.dll142_amsg_exit
msvcrt.dll155_beginthreadex
msvcrt.dll159_cexit
msvcrt.dll169_close
msvcrt.dll207_endthreadex
msvcrt.dll210_errno
msvcrt.dll232_filelengthi64
msvcrt.dll233_fileno
msvcrt.dll234_findclose
msvcrt.dll255_fstat64
msvcrt.dll271_get_osfhandle
msvcrt.dll303_initterm
msvcrt.dll307_iob
msvcrt.dll414_lseeki64
msvcrt.dll569_onexit
msvcrt.dll622_setjmp3
msvcrt.dll681_strnicmp
msvcrt.dll713_telli64
msvcrt.dll728_ultoa
msvcrt.dll790_wchdir
msvcrt.dll791_wchmod
msvcrt.dll853_wfopen
msvcrt.dll858_wfullpath
msvcrt.dll859_wgetcwd
msvcrt.dll869_wmkdir
msvcrt.dll871_wopen
msvcrt.dll883_wrename
msvcrt.dll922abort
msvcrt.dll931atoi
msvcrt.dll935calloc
msvcrt.dll945exit
msvcrt.dll948fclose
msvcrt.dll951fflush
msvcrt.dll953fgetpos
msvcrt.dll959fopen
msvcrt.dll961fprintf
msvcrt.dll963fputc
msvcrt.dll964fputs
msvcrt.dll967fread
msvcrt.dll968free
msvcrt.dll975fsetpos
msvcrt.dll980fwrite
msvcrt.dll983getc
msvcrt.dll985getenv
msvcrt.dll988getwc
msvcrt.dll998islower
msvcrt.dll1001isspace
msvcrt.dll1002isupper
msvcrt.dll1007iswctype
msvcrt.dll1020localeconv
msvcrt.dll1024malloc
msvcrt.dll1030memchr
msvcrt.dll1031memcmp
msvcrt.dll1032memcpy
msvcrt.dll1033memmove
msvcrt.dll1034memset
msvcrt.dll404localtime
msvcrt.dll1039printf
msvcrt.dll1041putc
msvcrt.dll1044putwc
msvcrt.dll1050realloc
msvcrt.dll1057setlocale
msvcrt.dll1058setvbuf
msvcrt.dll1059signal
msvcrt.dll1062sprintf
msvcrt.dll1069strchr
msvcrt.dll1070strcmp
msvcrt.dll1071strcoll
msvcrt.dll1075strerror
msvcrt.dll1076strftime
msvcrt.dll1077strlen
msvcrt.dll1080strncmp
msvcrt.dll1092strxfrm
msvcrt.dll1107towlower
msvcrt.dll1108towupper
msvcrt.dll1109ungetc
msvcrt.dll1110ungetwc
msvcrt.dll1111vfprintf
msvcrt.dll715time
msvcrt.dll1121wcscat
msvcrt.dll1124wcscmp
msvcrt.dll1125wcscoll
msvcrt.dll1126wcscpy
msvcrt.dll1129wcsftime
msvcrt.dll1130wcslen
msvcrt.dll1149wcsxfrm
msvcrt.dll1160_wutime
msvcrt.dll1162_wstat
msvcrt.dll1166_wfindnext
msvcrt.dll1167_wfindfirst
msvcrt.dll1195longjmp
msvcrt.dll1207_write
msvcrt.dll1234_strdup
msvcrt.dll1249_read
msvcrt.dll1276_fileno
msvcrt.dll1280_fdopen
msvcrt.dll1296_close
offsetsizetypecomment
15c115HTM#
15d017653272BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x21a610