filenamewinmine.exe
size190976 (0x2ea00)
md5136a1c1fb776a657d10f26ff63b5b085
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

Rich Header

lib idversiontimes used
2414011612
24340116156
2424011627
2592301322
2612301357
2602301365
203655015
10101
265230262
255230261
15101
258230261

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x562784f8
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.0
SizeOfCode0x1d800
SizeOfInitializedData0x11c00
SizeOfUninitializedData0
AddressOfEntryPoint0x6a70
BaseOfCode0x1000
BaseOfData0x1f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x33000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1d7a30x1d800R-X CODE
.rdata0x1f0000xa9b00xaa00R-- IDATA
.data0x2a0000x1e4c0x1200RW- IDATA
.tls0x2c00090x200RW- IDATA
.rsrc0x2d0000x2c200x2e00R-- IDATA
.reloc0x300000x210c0x2200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x291dc0x3c
RESOURCE0x2d0000x2c20
EXCEPTION00
SECURITY00
BASERELOC0x300000x210c
DEBUG0x270600x70
ARCHITECTURE00
GLOBALPTR00
TLS0x2712c0x18
LOAD_CONFIG0x270d00x40
Bound_IAT00
IAT0x1f0000x15c
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x42c0000x42c0080x42b6780x41f1ac00x300000
typenamesizecp
ICON#196400
GROUP_ICONMAINICON200
VERSION#19040
MANIFEST#13920
module_namehintordfunction_name
KERNEL32.dll1485WideCharToMultiByte
KERNEL32.dll293EnterCriticalSection
KERNEL32.dll930LeaveCriticalSection
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll289EncodePointer
KERNEL32.dll254DecodePointer
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll1291SetLastError
KERNEL32.dll840InitializeCriticalSectionAndSpinCount
KERNEL32.dll182CreateEventW
KERNEL32.dll1395TlsAlloc
KERNEL32.dll1397TlsGetValue
KERNEL32.dll1398TlsSetValue
KERNEL32.dll1396TlsFree
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll669GetProcAddress
KERNEL32.dll147CompareStringW
KERNEL32.dll918LCMapStringW
KERNEL32.dll596GetLocaleInfoW
KERNEL32.dll709GetStringTypeW
KERNEL32.dll435GetCPInfo
KERNEL32.dll127CloseHandle
KERNEL32.dll1264SetEvent
KERNEL32.dll1186ResetEvent
KERNEL32.dll1452WaitForSingleObjectEx
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1377TerminateProcess
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll843InitializeSListHead
KERNEL32.dll1197RtlUnwind
KERNEL32.dll1088RaiseException
KERNEL32.dll592GetLastError
KERNEL32.dll414FreeLibrary
KERNEL32.dll935LoadLibraryExW
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll266DeleteFileW
KERNEL32.dll822HeapReAlloc
KERNEL32.dll819HeapFree
KERNEL32.dll337ExitProcess
KERNEL32.dll614GetModuleHandleExW
KERNEL32.dll704GetStdHandle
KERNEL32.dll1505WriteFile
KERNEL32.dll610GetModuleFileNameA
KERNEL32.dll456GetCommandLineA
KERNEL32.dll457GetCommandLineW
KERNEL32.dll420GetACP
KERNEL32.dll574GetFileType
KERNEL32.dll1451WaitForSingleObject
KERNEL32.dll556GetExitCodeProcess
KERNEL32.dll215CreateProcessA
KERNEL32.dll562GetFileAttributesExW
KERNEL32.dll402FlushFileBuffers
KERNEL32.dll476GetConsoleCP
KERNEL32.dll494GetConsoleMode
KERNEL32.dll1104ReadFile
KERNEL32.dll1277SetFilePointerEx
KERNEL32.dll884IsValidLocale
KERNEL32.dll764GetUserDefaultLCID
KERNEL32.dll327EnumSystemLocalesW
KERNEL32.dll674GetProcessHeap
KERNEL32.dll882IsValidCodePage
KERNEL32.dll646GetOEMCP
KERNEL32.dll551GetEnvironmentStringsW
KERNEL32.dll413FreeEnvironmentStringsW
KERNEL32.dll1261SetEnvironmentVariableA
KERNEL32.dll360FindClose
KERNEL32.dll365FindFirstFileExA
KERNEL32.dll381FindNextFileA
KERNEL32.dll1314SetStdHandle
KERNEL32.dll1102ReadConsoleW
KERNEL32.dll1504WriteConsoleW
KERNEL32.dll194CreateFileW
KERNEL32.dll824HeapSize
KERNEL32.dll1258SetEndOfFile
KERNEL32.dll815HeapAlloc
KERNEL32.dll219CreateProcessW
ADVAPI32.dll794SystemFunction036

StringTable 040904b0

CommentsИгра ''Сапер''
CompanyNameMicrosoft Corp.
FileDescriptionИгра ''Сапер''
FileVersion5, 1, 2600, 0
InternalNameИгра ''Сапер''
LegalCopyrightКорпорация Майкрософт. Все права защищены.
OriginalFilenameWINMINE.EXE
ProductNameОперационная система Microsoft® Windows®
ProductVersion5, 1, 2600, 0

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0190976EXE10/21/2015 12:28:40#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[?] can't find file_offset of VA 0x2b678