filenamePEdump.exe
size125952 (0x1ec00)
md5117c4665efb14b4661de94662783601b
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
259337313
2603373111
2613373131
257337316
257307957
10140
261338131
255338131
258338131

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0xa
TimeDateStamp0x66b4679c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.40
SizeOfCode0x12200
SizeOfInitializedData0xce00
SizeOfUninitializedData0
AddressOfEntryPoint0x1155a
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x35000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.textbss0x10000x100000RWX CODE UDATA
.text0x110000x1201b0x12200R-X CODE
.rdata0x240000x5c6c0x5e00R-- IDATA
.data0x2a0000xed00x800RW- IDATA
.pdata0x2b0000x2a900x2c00R-- IDATA
.idata0x2e0000x23a30x2400R-- IDATA
.msvcjmc0x310000x2270x400RW- IDATA
.00cfg0x320000x1750x200R-- IDATA
.rsrc0x330000x43c0x600R-- IDATA
.reloc0x340000x3de0x400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x2e7400x8c
RESOURCE0x330000x43c
EXCEPTION0x2b0000x25a4
SECURITY00
BASERELOC0x340000x13c
DEBUG0x26d000x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x26b800x140
Bound_IAT00
IAT0x2e0000x740
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll497GetCommandLineW
KERNEL32.dll453FreeLibrary
KERNEL32.dll1543VirtualQuery
KERNEL32.dll724GetProcessHeap
KERNEL32.dll880HeapFree
KERNEL32.dll876HeapAlloc
KERNEL32.dll637GetLastError
KERNEL32.dll661GetModuleHandleW
KERNEL32.dll753GetStartupInfoW
KERNEL32.dll906InitializeSListHead
KERNEL32.dll778GetSystemTimeAsFileTime
KERNEL32.dll563GetCurrentProcessId
KERNEL32.dll1136QueryPerformanceCounter
KERNEL32.dll936IsProcessorFeaturePresent
KERNEL32.dll1476TerminateProcess
KERNEL32.dll562GetCurrentProcess
KERNEL32.dll1444SetUnhandledExceptionFilter
KERNEL32.dll1510UnhandledExceptionFilter
KERNEL32.dll1284RtlVirtualUnwind
KERNEL32.dll1277RtlLookupFunctionEntry
KERNEL32.dll1269RtlCaptureContext
KERNEL32.dll1591WideCharToMultiByte
KERNEL32.dll1042MultiByteToWideChar
KERNEL32.dll1159RaiseException
KERNEL32.dll928IsDebuggerPresent
KERNEL32.dll567GetCurrentThreadId
KERNEL32.dll717GetProcAddress
SHELL32.dll9CommandLineToArgvW
MSVCP140D.dll490protected: __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Gnavail(void)const __ptr64

?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ

MSVCP140D.dll1097protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::pbump(int) __ptr64

?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

MSVCP140D.dll594protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Pninc(void) __ptr64

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

MSVCP140D.dll591protected: __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Pnavail(void)const __ptr64

?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ

MSVCP140D.dll509protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Init(void) __ptr64

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

MSVCP140D.dll508protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Init(char * __ptr64 * __ptr64, char * __ptr64 * __ptr64, int * __ptr64, char * __ptr64 * __ptr64, char * __ptr64 * __ptr64, int * __ptr64) __ptr64

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z

MSVCP140D.dll1355protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsgetn(char * __ptr64, __int64) __ptr64

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

MSVCP140D.dll1358protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsputn(char const * __ptr64, __int64) __ptr64

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

MSVCP140D.dll125public: virtual __cdecl std::basic_ios<char, struct std::char_traits<char> >::~basic_ios<char, struct std::char_traits<char> >(void) __ptr64

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

MSVCP140D.dll1229public: void __cdecl std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) __ptr64

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

MSVCP140D.dll12protected: __cdecl std::basic_ios<char, struct std::char_traits<char> >::basic_ios<char, struct std::char_traits<char> >(void) __ptr64

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

MSVCP140D.dll26public: __cdecl std::basic_istream<char, struct std::char_traits<char> >::basic_istream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64, bool) __ptr64

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

MSVCP140D.dll131public: virtual __cdecl std::basic_istream<char, struct std::char_traits<char> >::~basic_istream<char, struct std::char_traits<char> >(void) __ptr64

??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

MSVCP140D.dll1191public: class std::basic_istream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_istream<char, struct std::char_traits<char> >::seekg(__int64, int) __ptr64

?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z

MSVCP140D.dll1291public: class std::fpos<struct _Mbstatet> __cdecl std::basic_istream<char, struct std::char_traits<char> >::tellg(void) __ptr64

?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ

MSVCP140D.dll437struct _iobuf * __ptr64 __cdecl std::_Fiopen(wchar_t const * __ptr64, int, int)

?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z

MSVCP140D.dll1245protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::showmanyc(void) __ptr64

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

MSVCP140D.dll977public: static class std::locale::id std::codecvt<char, char, struct _Mbstatet>::id

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

MSVCP140D.dll659void __cdecl std::_Xbad_alloc(void)

?_Xbad_alloc@std@@YAXXZ

MSVCP140D.dll496protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Gninc(void) __ptr64

?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

MSVCP140D.dll109public: __cdecl std::_Lockit::_Lockit(int) __ptr64

??0_Lockit@std@@QEAA@H@Z

MSVCP140D.dll165public: __cdecl std::_Lockit::~_Lockit(void) __ptr64

??1_Lockit@std@@QEAA@XZ

MSVCP140D.dll662void __cdecl std::_Xlength_error(char const * __ptr64)

?_Xlength_error@std@@YAXPEBD@Z

MSVCP140D.dll663void __cdecl std::_Xout_of_range(char const * __ptr64)

?_Xout_of_range@std@@YAXPEBD@Z

MSVCP140D.dll311public: __cdecl std::locale::id::operator unsigned __int64(void) __ptr64

??Bid@locale@std@@QEAA_KXZ

MSVCP140D.dll477private: static class std::locale::_Locimp * __ptr64 __cdecl std::locale::_Getgloballocale(void)

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

MSVCP140D.dll677public: bool __cdecl std::codecvt_base::always_noconv(void)const __ptr64

?always_noconv@codecvt_base@std@@QEBA_NXZ

MSVCP140D.dll1026public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::in(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

MSVCP140D.dll1083public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::out(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

MSVCP140D.dll1327public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::unshift(struct _Mbstatet & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64

?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

MSVCP140D.dll441public: static unsigned __int64 __cdecl std::codecvt<char, char, struct _Mbstatet>::_Getcat(class std::locale::facet const * __ptr64 * __ptr64, class std::locale const * __ptr64)

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

MSVCP140D.dll973public: bool __cdecl std::ios_base::good(void)const __ptr64

?good@ios_base@std@@QEBA_NXZ

MSVCP140D.dll47protected: __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

MSVCP140D.dll137public: virtual __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::~basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

MSVCP140D.dll968public: class std::locale __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::getloc(void)const __ptr64

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

MSVCP140D.dll853protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::eback(void)const __ptr64

?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

MSVCP140D.dll974protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::gptr(void)const __ptr64

?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

MSVCP140D.dll1103protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::pptr(void)const __ptr64

?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

MSVCP140D.dll856protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::egptr(void)const __ptr64

?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

MSVCP140D.dll883protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::gbump(int) __ptr64

?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

MSVCP140D.dll1218protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::setg(char * __ptr64, char * __ptr64, char * __ptr64) __ptr64

?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

MSVCP140D.dll865protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::epptr(void)const __ptr64

?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

MSVCP140D.dll493protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Gndec(void) __ptr64

?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

VCRUNTIME140D.dll61memmove
VCRUNTIME140D.dll33__std_exception_copy
VCRUNTIME140D.dll34__std_exception_destroy
VCRUNTIME140D.dll1_CxxThrowException
VCRUNTIME140D.dll8__C_specific_handler
VCRUNTIME140D.dll9__C_specific_handler_noexcept
VCRUNTIME140D.dll37__std_type_info_destroy_list
VCRUNTIME140D.dll27__current_exception
VCRUNTIME140D.dll28__current_exception_context
VCRUNTIME140D.dll46__vcrt_GetModuleFileNameW
VCRUNTIME140D.dll47__vcrt_GetModuleHandleW
VCRUNTIME140D.dll49__vcrt_LoadLibraryExW
VCRUNTIME140D.dll60memcpy
VCRUNTIME140_1D.dll__CxxFrameHandler4
ucrtbased.dll182_configure_narrow_argv
ucrtbased.dll369_initialize_narrow_environment
ucrtbased.dll317_get_initial_narrow_environment
ucrtbased.dll372_initterm
ucrtbased.dll373_initterm_e
ucrtbased.dll1104exit
ucrtbased.dll234_exit
ucrtbased.dll715_set_fmode
ucrtbased.dll73__p___argc
ucrtbased.dll74__p___argv
ucrtbased.dll164_cexit
ucrtbased.dll159_c_exit
ucrtbased.dll694_register_thread_local_exe_atexit_callback
ucrtbased.dll181_configthreadlocale
ucrtbased.dll718_set_new_mode
ucrtbased.dll77__p__commode
ucrtbased.dll706_seh_filter_dll
ucrtbased.dll710_set_app_type
ucrtbased.dll693_register_onexit_function
ucrtbased.dll229_execute_onexit_table
ucrtbased.dll194_crt_atexit
ucrtbased.dll193_crt_at_quick_exit
ucrtbased.dll1324strcpy_s
ucrtbased.dll1320strcat_s
ucrtbased.dll104__stdio_common_vsprintf_s
ucrtbased.dll1355terminate
ucrtbased.dll924_wmakepath_s
ucrtbased.dll952_wsplitpath_s
ucrtbased.dll1380wcscpy_s
ucrtbased.dll1129fflush
ucrtbased.dll1114fclose
ucrtbased.dll324_get_stream_buffer_pointers
ucrtbased.dll4_CrtDbgReport
ucrtbased.dll96__stdio_common_vfwprintf
ucrtbased.dll53__acrt_iob_func
ucrtbased.dll374_invalid_parameter
ucrtbased.dll91__setusermatherr
ucrtbased.dll5_CrtDbgReportW
ucrtbased.dll1130fgetc
ucrtbased.dll161_callnewh
ucrtbased.dll517_malloc_dbg
ucrtbased.dll285_free_dbg
ucrtbased.dll826_unlock_file
ucrtbased.dll499_lock_file
ucrtbased.dll1371ungetc
ucrtbased.dll1310setvbuf
ucrtbased.dll707_seh_filter_exe
ucrtbased.dll1163fwrite
ucrtbased.dll288_fseeki64
ucrtbased.dll1161fsetpos
ucrtbased.dll1154fread
ucrtbased.dll370_initialize_onexit_table
ucrtbased.dll1131fgetpos
ucrtbased.dll1240malloc
ucrtbased.dll1150fputc
offsetsizetypecomment
15c115HTM#
15d0120368BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK