PBMHelper.exe

info
MZ
PE
resources
strings
imports
foremost
hexdump
disasm
log
discuss
donate

filename	PBMHelper.exe
size	66560 (0x10400)
md5	0e68f6da2c67c32c336d88fed37c68b7

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
150	20413	1
149	30729	2
131	30729	19
132	30729	9
123	50727	12
147	30729	5
1	0	86
138	30729	2
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	6
TimeDateStamp	0x50a69a47
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0x1e00
SizeOfInitializedData	0xe200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x23f8
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x15000
SizeOfHeaders	0x400
CheckSum	0x139f1
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1dfe	0x1e00	R-X CODE
.rdata	0x3000	0x16c8	0x1800	R-- IDATA
.data	0x5000	0x820	0x200	RW- IDATA
.pdata	0x6000	0x2a0	0x400	R-- IDATA
.rsrc	0x7000	0xc128	0xc200	R-- IDATA
.reloc	0x14000	0xec	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x3df8	0xb4
RESOURCE	0x7000	0xc128
EXCEPTION	0x6000	0x2a0
SECURITY	0	0
BASERELOC	0x14000	0x2c
DEBUG	0x3300	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x3000	0x2b8
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
ICON	#1	744	1252
ICON	#2	296	1252
ICON	#3	3752	1252
ICON	#4	2216	1252
ICON	#5	1384	1252
ICON	#6	9640	1252
ICON	#7	4264	1252
ICON	#8	1128	1252
ICON	#9	744	1252
ICON	#10	296	1252
ICON	#11	3752	1252
ICON	#12	2216	1252
ICON	#13	1384	1252
ICON	#14	9640	1252
ICON	#15	4264	1252
ICON	#16	1128	1252
MENU	#109	74	1252
DIALOG	#103	312	1252
STRING	#7	68	1252
ACCELERATORS	#109	16	1252
GROUP_ICON	#107	118	1252
GROUP_ICON	#108	118	1252
MANIFEST	#1	600	1252

id	lang	string
103	1033	PBMHelper
109	1033	PBMHELPER

module_name	hint	ord	function_name
Wavx_ESC_Logging.dll	4		_PrintExit
Wavx_ESC_Logging.dll	1		_Print
Wavx_ESC_Logging.dll			_InitLogging
Wavx_ESC_Logging.dll	2		_PrintEnter
KERNEL32.dll	715		IsDebuggerPresent
KERNEL32.dll	788		MultiByteToWideChar
KERNEL32.dll	1213		lstrlenA
KERNEL32.dll	759		LocalFree
KERNEL32.dll	109		CreateDirectoryA
KERNEL32.dll	591		GetSystemTimeAsFileTime
KERNEL32.dll	427		GetCurrentProcessId
KERNEL32.dll	430		GetCurrentThreadId
KERNEL32.dll	614		GetTickCount
KERNEL32.dll	846		QueryPerformanceCounter
KERNEL32.dll	905		RtlCaptureContext
KERNEL32.dll	912		RtlLookupFunctionEntry
KERNEL32.dll	919		RtlVirtualUnwind
KERNEL32.dll	486		GetLastError
KERNEL32.dll	1049		SetUnhandledExceptionFilter
KERNEL32.dll	1090		UnhandledExceptionFilter
KERNEL32.dll	426		GetCurrentProcess
KERNEL32.dll	1073		TerminateProcess
KERNEL32.dll	570		GetStartupInfoW
KERNEL32.dll	1061		Sleep
USER32.dll	473		LoadCursorW
USER32.dll	569		RegisterClassExW
USER32.dll	488		LoadStringW
USER32.dll	475		LoadIconW
USER32.dll	467		LoadAcceleratorsW
USER32.dll	211		EndDialog
USER32.dll	548		PostQuitMessage
USER32.dll	213		EndPaint
USER32.dll	14		BeginPaint
USER32.dll	150		DefWindowProcW
USER32.dll	160		DestroyWindow
USER32.dll	166		DialogBoxParamW
SHELL32.dll	188		SHGetFolderPathA
ole32.dll	311		OleRun
ole32.dll	20		CoCreateInstance
ole32.dll	111		CoUninitialize
ole32.dll	65		CoInitialize
OLEAUT32.dll		6
OLEAUT32.dll		2
OLEAUT32.dll		200
OLEAUT32.dll		9
SHLWAPI.dll	51		PathAppendA
MSVCR90.dll	740		_onexit
MSVCR90.dll	301		_decode_pointer
MSVCR90.dll	131		__crt_debugger_hook
MSVCR90.dll	573		_lock
MSVCR90.dll	133		__dllonexit
MSVCR90.dll	932		_unlock
MSVCR90.dll	67		void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCR90.dll	249		_cexit
MSVCR90.dll	19		void __cdecl operator delete(void * __ptr64) ??3@YAXPEAX@Z
MSVCR90.dll	17		void * __ptr64 __cdecl operator new(unsigned __int64) ??2@YAPEAX_K@Z
MSVCR90.dll	35		void __cdecl operator delete[](void * __ptr64) ??_V@YAXPEAX@Z
MSVCR90.dll	1388		wcsstr
MSVCR90.dll	1373		wcscpy_s
MSVCR90.dll	1196		free
MSVCR90.dll	1253		malloc
MSVCR90.dll	99		__CxxFrameHandler3
MSVCR90.dll	73		_CxxThrowException
MSVCR90.dll	226		_amsg_exit
MSVCR90.dll	211		__wgetmainargs
MSVCR90.dll	89		__C_specific_handler
MSVCR90.dll	85		_XcptFilter
MSVCR90.dll	326		_exit
MSVCR90.dll	188		__set_app_type
MSVCR90.dll	1169		exit
MSVCR90.dll	1000		_wcmdln
MSVCR90.dll	462		_initterm
MSVCR90.dll	463		_initterm_e
MSVCR90.dll	265		_configthreadlocale
MSVCR90.dll	191		__setusermatherr
MSVCR90.dll	264		_commode
MSVCR90.dll	354		_fmode
MSVCR90.dll	311		_encode_pointer
MSVCR90.dll	56		public: void __cdecl type_info::_type_info_dtor_internal_method(void) __ptr64 ?_type_info_dtor_internal_method@type_info@@QEAAXXZ

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	60976	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK