filenameLauncher.exe
size3083776 (0x2f0e00)
md515f21f990ff5a53a680e654d9485dda3
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x138

Rich Header

lib idversiontimes used
2414011620
24340116180
2424011630
199411186
2592670626
26126706122
2602670638
26027031665
0024
171303191
131307293
123507272
1473072923
10320
26527031219
255270311
15101
258270311

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5e8efe14
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.16
SizeOfCode0x2b6200
SizeOfInitializedData0x50a00
SizeOfUninitializedData0
AddressOfEntryPoint0x1f2b09
BaseOfCode0x1000
BaseOfData0x2b8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.1
ImageVersion0.0
SubsystemVersion5.1
Reserved10
SizeOfImage0x30a000
SizeOfHeaders0x400
CheckSum0x2f43b6
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x2b61d40x2b6200R-X CODE
.data0x2b80000x1e2e00x8200RW- IDATA
.idata0x2d70000x1d280x1e00R-- IDATA
.rsrc0x2d90000x188500x18a00R-- IDATA
.reloc0x2f20000x17cac0x17e00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x2d74940xdc
RESOURCE0x2d90000x18850
EXCEPTION00
SECURITY00
BASERELOC0x2f20000x17cac
DEBUG0x776800x54
ARCHITECTURE00
GLOBALPTR00
TLS0x777780x18
LOAD_CONFIG0x776d80x40
Bound_IAT00
IAT0x2d70000x490
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x6b38f40x6b38fc0x6c10280x40108800x300000
typenamesizecp
ICON#111280
ICON#224400
ICON#342640
ICON#496400
ICON#5811130
GROUP_ICON#101760
VERSION#17120
MANIFEST#15480
module_namehintordfunction_name
IMM32.dll120ImmSetStatusWindowPos
IMM32.dll56ImmGetContext
IMM32.dll104ImmReleaseContext
IMM32.dll88ImmIsIME
d3d9.dll9Direct3DCreate9
WS2_32.dll22
WS2_32.dll115
WS2_32.dll3
WS2_32.dll11
WS2_32.dll52
WS2_32.dll17
WS2_32.dll20
WS2_32.dll151
WS2_32.dll18
WS2_32.dll1
WS2_32.dll13
WS2_32.dll116
WS2_32.dll57
WS2_32.dll137getaddrinfo
WS2_32.dll136freeaddrinfo
WS2_32.dll2
WS2_32.dll54WSAIoctl
WS2_32.dll112
WS2_32.dll5
WS2_32.dll6
WS2_32.dll7
WS2_32.dll9
WS2_32.dll19
WS2_32.dll15
WS2_32.dll16
WS2_32.dll10
WS2_32.dll101
WS2_32.dll4
WS2_32.dll21
WS2_32.dll111
WS2_32.dll23
WS2_32.dll141getnameinfo
DINPUT8.dllDirectInput8Create
KERNEL32.dll1257VirtualAlloc
KERNEL32.dll533GetModuleHandleA
KERNEL32.dll581GetProcAddress
KERNEL32.dll830LoadLibraryExW
KERNEL32.dll238EnterCriticalSection
KERNEL32.dll825LeaveCriticalSection
KERNEL32.dll209DeleteCriticalSection
KERNEL32.dll751InterlockedIncrement
KERNEL32.dll1022ReleaseSemaphore
KERNEL32.dll738InitializeCriticalSection
KERNEL32.dll1273WaitForSingleObject
KERNEL32.dll1113SetEvent
KERNEL32.dll1039ResetEvent
KERNEL32.dll171CreateSemaphoreA
KERNEL32.dll130CreateEventA
KERNEL32.dll1202Sleep
KERNEL32.dll1216TerminateProcess
KERNEL32.dll448GetCurrentProcess
KERNEL32.dll659GetTickCount
KERNEL32.dll282ExitThread
KERNEL32.dll211DeleteFileA
KERNEL32.dll181CreateThread
KERNEL32.dll480GetExitCodeThread
KERNEL32.dll612GetStdHandle
KERNEL32.dll391GetCommandLineW
KERNEL32.dll840LocalFree
KERNEL32.dll1357lstrlenA
KERNEL32.dll515GetLocalTime
KERNEL32.dll1342lstrcatA
KERNEL32.dll531GetModuleFileNameA
KERNEL32.dll828LoadLibraryA
KERNEL32.dll1348lstrcmpiA
KERNEL32.dll446GetCurrentDirectoryA
KERNEL32.dll449GetCurrentProcessId
KERNEL32.dll323FindNextFileA
KERNEL32.dll302FindClose
KERNEL32.dll447GetCurrentDirectoryW
KERNEL32.dll1205SleepEx
KERNEL32.dll284ExpandEnvironmentStringsA
KERNEL32.dll1139SetLastError
KERNEL32.dll349FormatMessageA
KERNEL32.dll1255VerifyVersionInfoA
KERNEL32.dll623GetSystemDirectoryA
KERNEL32.dll1252VerSetConditionMask
KERNEL32.dll1271WaitForMultipleObjects
KERNEL32.dll909PeekNamedPipe
KERNEL32.dll354FreeLibrary
KERNEL32.dll499GetFileType
KERNEL32.dll476GetEnvironmentVariableW
KERNEL32.dll428GetConsoleMode
KERNEL32.dll1085SetConsoleMode
KERNEL32.dll948ReadConsoleA
KERNEL32.dll958ReadConsoleW
KERNEL32.dll739InitializeCriticalSectionAndSpinCount
KERNEL32.dll453GetCurrentThreadId
KERNEL32.dll1221TlsAlloc
KERNEL32.dll496GetFileSize
KERNEL32.dll1224TlsSetValue
KERNEL32.dll1222TlsFree
KERNEL32.dll536GetModuleHandleW
KERNEL32.dll871MultiByteToWideChar
KERNEL32.dll535GetModuleHandleExW
KERNEL32.dll935QueryPerformanceCounter
KERNEL32.dll633GetSystemTimeAsFileTime
KERNEL32.dll350FormatMessageW
KERNEL32.dll1211SwitchToFiber
KERNEL32.dll210DeleteFiber
KERNEL32.dll134CreateFiber
KERNEL32.dll831LoadLibraryW
KERNEL32.dll106ConvertFiberToThread
KERNEL32.dll109ConvertThreadToFiber
KERNEL32.dll313FindFirstFileW
KERNEL32.dll325FindNextFileW
KERNEL32.dll631GetSystemTime
KERNEL32.dll1213SystemTimeToFileTime
KERNEL32.dll293FileTimeToSystemTime
KERNEL32.dll1214SystemTimeToTzSpecificLocalTime
KERNEL32.dll467GetDriveTypeW
KERNEL32.dll1127SetFilePointerEx
KERNEL32.dll281ExitProcess
KERNEL32.dll945RaiseException
KERNEL32.dll1048RtlUnwind
KERNEL32.dll188CreateTimerQueue
KERNEL32.dll1243UnregisterWaitEx
KERNEL32.dll926QueryDepthSList
KERNEL32.dll750InterlockedFlushSList
KERNEL32.dll753InterlockedPushEntrySList
KERNEL32.dll752InterlockedPopEntrySList
KERNEL32.dll232DuplicateHandle
KERNEL32.dll1263VirtualProtect
KERNEL32.dll676GetVersionExW
KERNEL32.dll532GetModuleFileNameW
KERNEL32.dll355FreeLibraryAndExitThread
KERNEL32.dll657GetThreadTimes
KERNEL32.dll452GetCurrentThread
KERNEL32.dll1242UnregisterWait
KERNEL32.dll1013RegisterWaitForSingleObject
KERNEL32.dll1168SetThreadAffinityMask
KERNEL32.dll1265VirtualQuery
KERNEL32.dll582GetProcessAffinityMask
KERNEL32.dll553GetNumaHighestNodeNumber
KERNEL32.dll218DeleteTimerQueueTimer
KERNEL32.dll72ChangeTimerQueueTimer
KERNEL32.dll189CreateTimerQueueTimer
KERNEL32.dll522GetLogicalProcessorInformation
KERNEL32.dll654GetThreadPriority
KERNEL32.dll1177SetThreadPriority
KERNEL32.dll1200SignalObjectAndWait
KERNEL32.dll743InitializeSListHead
KERNEL32.dll772IsProcessorFeaturePresent
KERNEL32.dll611GetStartupInfoW
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1235UnhandledExceptionFilter
KERNEL32.dll768IsDebuggerPresent
KERNEL32.dll1274WaitForSingleObjectEx
KERNEL32.dll370GetCPInfo
KERNEL32.dll617GetStringTypeW
KERNEL32.dll518GetLocaleInfoW
KERNEL32.dll82CloseHandle
KERNEL32.dll136CreateFileA
KERNEL32.dll143CreateFileW
KERNEL32.dll1126SetFilePointer
KERNEL32.dll1317WriteFile
KERNEL32.dll960ReadFile
KERNEL32.dll514GetLastError
KERNEL32.dll1297WideCharToMultiByte
KERNEL32.dll1069SetConsoleCtrlHandler
KERNEL32.dll360GetACP
KERNEL32.dll410GetConsoleCP
KERNEL32.dll719HeapFree
KERNEL32.dll715HeapAlloc
KERNEL32.dll780IsValidLocale
KERNEL32.dll667GetUserDefaultLCID
KERNEL32.dll271EnumSystemLocalesW
KERNEL32.dll343FlushFileBuffers
KERNEL32.dll722HeapReAlloc
KERNEL32.dll1159SetStdHandle
KERNEL32.dll507GetFullPathNameW
KERNEL32.dll487GetFileAttributesExW
KERNEL32.dll664GetTimeZoneInformation
KERNEL32.dll307FindFirstFileExA
KERNEL32.dll778IsValidCodePage
KERNEL32.dll567GetOEMCP
KERNEL32.dll390GetCommandLineA
KERNEL32.dll474GetEnvironmentStringsW
KERNEL32.dll353FreeEnvironmentStringsW
KERNEL32.dll1110SetEnvironmentVariableA
KERNEL32.dll813LCMapStringW
KERNEL32.dll100CompareStringW
KERNEL32.dll1212SwitchToThread
KERNEL32.dll133CreateEventW
KERNEL32.dll202DecodePointer
KERNEL32.dll234EncodePointer
KERNEL32.dll1230TryEnterCriticalSection
KERNEL32.dll586GetProcessHeap
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll1316WriteConsoleW
KERNEL32.dll724HeapSize
KERNEL32.dll1260VirtualFree
KERNEL32.dll1223TlsGetValue
USER32.dll345GetMessageA
USER32.dll567PostQuitMessage
USER32.dll562PeekMessageA
USER32.dll263GetAsyncKeyState
USER32.dll764TranslateMessage
USER32.dll533MessageBoxW
USER32.dll395GetUserObjectInformationW
USER32.dll360GetProcessWindowStation
USER32.dll318GetKeyboardLayout
USER32.dll714SetWindowTextA
USER32.dll658SetFocus
USER32.dll300GetFocus
USER32.dll29CallWindowProcA
USER32.dll631SendMessageA
USER32.dll35ChangeDisplaySettingsA
USER32.dll289GetDC
USER32.dll43CharLowerA
USER32.dll299GetDoubleClickTime
USER32.dll576PtInRect
USER32.dll621ScreenToClient
USER32.dll276GetClientRect
USER32.dll256GetActiveWindow
USER32.dll686SetRect
USER32.dll785UpdateWindow
USER32.dll735ShowWindow
USER32.dll45CharLowerBuffW
USER32.dll109CreateWindowExA
USER32.dll382GetSystemMetrics
USER32.dll588RegisterClassExA
USER32.dll488LoadCursorA
USER32.dll492LoadIconA
USER32.dll155DefWindowProcA
USER32.dll220EndPaint
USER32.dll14BeginPaint
USER32.dll539MoveWindow
USER32.dll412GetWindowRect
USER32.dll288GetCursorPos
USER32.dll586RedrawWindow
USER32.dll58CharUpperBuffA
USER32.dll44CharLowerBuffA
USER32.dll526MessageBoxA
USER32.dll174DispatchMessageA
GDI32.dll638SetBkColor
GDI32.dll48CreateCompatibleDC
GDI32.dll459GetDeviceCaps
GDI32.dll311ExtTextOutA
GDI32.dll676SetTextAlign
GDI32.dll60CreateFontA
GDI32.dll631SelectObject
GDI32.dll84CreateSolidBrush
GDI32.dll678SetTextColor
GDI32.dll53CreateDIBSection
GDI32.dll541GetTextExtentPoint32A
GDI32.dll660SetMapMode
GDI32.dll227DeleteDC
GDI32.dll230DeleteObject
ADVAPI32.dll182CryptDestroyHash
ADVAPI32.dll176CryptAcquireContextA
ADVAPI32.dll179CryptCreateHash
ADVAPI32.dll200CryptHashData
ADVAPI32.dll203CryptReleaseContext
ADVAPI32.dll180CryptDecrypt
ADVAPI32.dll219DeregisterEventSource
ADVAPI32.dll643RegisterEventSourceW
ADVAPI32.dll655ReportEventW
ADVAPI32.dll177CryptAcquireContextW
ADVAPI32.dll181CryptDeriveKey
ADVAPI32.dll193CryptGenRandom
ADVAPI32.dll190CryptEnumProvidersW
ADVAPI32.dll212CryptSignHashW
ADVAPI32.dll191CryptExportKey
ADVAPI32.dll199CryptGetUserKey
ADVAPI32.dll198CryptGetProvParam
ADVAPI32.dll204CryptSetHashParam
ADVAPI32.dll183CryptDestroyKey
SHELL32.dll6CommandLineToArgvW
SHELL32.dll286ShellExecuteA
CRYPT32.dll87CertOpenStore
CRYPT32.dll70CertGetCertificateContextProperty
CRYPT32.dll44CertEnumCertificatesInStore
CRYPT32.dll53CertFindCertificateInStore
CRYPT32.dll37CertDuplicateCertificateContext
CRYPT32.dll18CertCloseStore
CRYPT32.dll64CertFreeCertificateContext

StringTable 041f04b0

CompanyNamexACS
FileDescriptionDarkKO Launcher
FileVersion1.0.0.1
InternalNameLauncher.exe
LegalCopyrightCopyright (C) 2019 xACS
OriginalFilenameLauncher.exe
ProductNameDarkKO Launcher
ProductVersion1.0.0.1

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
03083776EXE04/09/2020 10:51:00#
15c115HTM#
2c4c3081113PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x2c1028