main.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	main.exe
size	1958955 (0x1de42b)
md5	1a4e2ff76ce42e7c7a69562f0a32f808

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	0xf
TimeDateStamp	0x50816f60
PointerToSymbolTable	0x185600
NumberOfSymbols	0x29b4
SizeOfOptionalHeader	0xe0
Characteristics	0x127
Magic	0x10b
LinkerVersion	2.56
SizeOfCode	0x7a200
SizeOfInitializedData	0xafc00
SizeOfUninitializedData	0xa7800
AddressOfEntryPoint	0x1290
BaseOfCode	0x1000
BaseOfData	0x7c000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x235000
SizeOfHeaders	0x400
CheckSum	0x1e85df
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x2000000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x7a070	0x7a200	R-X CODE IDATA
.data	0x7c000	0x21ae4	0x21c00	RW- IDATA
/4	0x9e000	0x12220	0x12400	RW- IDATA
.bss	0xb1000	0xa77c0	0	RW- UDATA
.idata	0x159000	0x15ec	0x1600	RW- IDATA
.CRT	0x15b000	0x18	0x200	RW- IDATA
.tls	0x15c000	0x20	0x200	RW- IDATA
/14	0x15d000	0x6a8	0x800	R-- DISCARDABLE
/29	0x15e000	0x98d59	0x98e00	R-- DISCARDABLE
/41	0x1f7000	0x5ec2	0x6000	R-- DISCARDABLE
/55	0x1fd000	0x14367	0x14400	R-- DISCARDABLE
/67	0x212000	0x7eec	0x8000	R-- DISCARDABLE
/80	0x21a000	0x5cba	0x5e00	R-- DISCARDABLE
/91	0x220000	0x1293e	0x12a00	R-- DISCARDABLE
/102	0x233000	0x1290	0x1400	R-- DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x159000	0x15ec
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x15c000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x55c019	0x55c01c	0x557d78	0x55b004	0	0

module_name	hint	function_name
ADVAPI32.DLL	2	AccessCheck
ADVAPI32.DLL	33	BuildExplicitAccessWithNameW
ADVAPI32.DLL	192	GetFileSecurityW
ADVAPI32.DLL	207	GetNamedSecurityInfoW
ADVAPI32.DLL	246	GetUserNameW
ADVAPI32.DLL	252	ImpersonateSelf
ADVAPI32.DLL	340	MapGenericMask
ADVAPI32.DLL	362	OpenThreadToken
ADVAPI32.DLL	404	RegEnumValueA
ADVAPI32.DLL	413	RegOpenKeyExA
ADVAPI32.DLL	451	RevertToSelf
ADVAPI32.DLL	456	SetEntriesInAclW
ADVAPI32.DLL	465	SetNamedSecurityInfoW
KERNEL32.dll	82	CloseHandle
KERNEL32.dll	142	CreateFileW
KERNEL32.dll	166	CreateProcessW
KERNEL32.dll	169	CreateSemaphoreA
KERNEL32.dll	207	DeleteCriticalSection
KERNEL32.dll	236	EnterCriticalSection
KERNEL32.dll	279	ExitProcess
KERNEL32.dll	283	ExpandEnvironmentStringsW
KERNEL32.dll	291	FileTimeToSystemTime
KERNEL32.dll	300	FindClose
KERNEL32.dll	311	FindFirstFileW
KERNEL32.dll	323	FindNextFileW
KERNEL32.dll	340	FlushConsoleInputBuffer
KERNEL32.dll	352	FreeLibrary
KERNEL32.dll	388	GetCommandLineA
KERNEL32.dll	389	GetCommandLineW
KERNEL32.dll	446	GetCurrentProcess
KERNEL32.dll	450	GetCurrentThread
KERNEL32.dll	465	GetDriveTypeW
KERNEL32.dll	477	GetExitCodeProcess
KERNEL32.dll	481	GetFileAttributesA
KERNEL32.dll	483	GetFileAttributesExW
KERNEL32.dll	486	GetFileAttributesW
KERNEL32.dll	494	GetFileTime
KERNEL32.dll	510	GetLastError
KERNEL32.dll	529	GetModuleHandleA
KERNEL32.dll	566	GetPriorityClass
KERNEL32.dll	577	GetProcAddress
KERNEL32.dll	582	GetProcessHeap
KERNEL32.dll	608	GetStdHandle
KERNEL32.dll	623	GetSystemInfo
KERNEL32.dll	660	GetTimeZoneInformation
KERNEL32.dll	670	GetVersion
KERNEL32.dll	672	GetVersionExW
KERNEL32.dll	711	HeapAlloc
KERNEL32.dll	715	HeapFree
KERNEL32.dll	734	InitializeCriticalSection
KERNEL32.dll	743	InterlockedDecrement
KERNEL32.dll	744	InterlockedExchange
KERNEL32.dll	747	InterlockedIncrement
KERNEL32.dll	752	IsBadCodePtr
KERNEL32.dll	763	IsDBCSLeadByteEx
KERNEL32.dll	814	LeaveCriticalSection
KERNEL32.dll	817	LoadLibraryA
KERNEL32.dll	829	LocalFree
KERNEL32.dll	860	MultiByteToWideChar
KERNEL32.dll	978	ReleaseSemaphore
KERNEL32.dll	1005	SearchPathW
KERNEL32.dll	1073	SetFileAttributesW
KERNEL32.dll	1082	SetFileTime
KERNEL32.dll	1088	SetHandleInformation
KERNEL32.dll	1140	SetUnhandledExceptionFilter
KERNEL32.dll	1152	Sleep
KERNEL32.dll	1163	SystemTimeToFileTime
KERNEL32.dll	1164	SystemTimeToTzSpecificLocalTime
KERNEL32.dll	1173	TlsGetValue
KERNEL32.dll	1213	VirtualProtect
KERNEL32.dll	1215	VirtualQuery
KERNEL32.dll	1221	WaitForMultipleObjects
KERNEL32.dll	1223	WaitForSingleObject
KERNEL32.dll	1247	WideCharToMultiByte
msvcrt.dll	6	_close
msvcrt.dll	10	_dup
msvcrt.dll	11	_dup2
msvcrt.dll	32	_fstat
msvcrt.dll	35	_getch
msvcrt.dll	38	_getpid
msvcrt.dll	42	_isatty
msvcrt.dll	47	_kbhit
msvcrt.dll	51	_lseek
msvcrt.dll	56	_mktemp
msvcrt.dll	58	_open
msvcrt.dll	62	_putenv
msvcrt.dll	64	_read
msvcrt.dll	76	_spawnvp
msvcrt.dll	109	_write
msvcrt.dll	55	__getmainargs
msvcrt.dll	61	__lc_codepage
msvcrt.dll	65	__mb_cur_max
msvcrt.dll	77	__p__environ
msvcrt.dll	79	__p__fmode
msvcrt.dll	99	__set_app_type
msvcrt.dll	147	_cexit
msvcrt.dll	182	_errno
msvcrt.dll	200	_filbuf
msvcrt.dll	205	_findclose
msvcrt.dll	213	_flsbuf
msvcrt.dll	228	_fullpath
msvcrt.dll	233	_get_osfhandle
msvcrt.dll	251	_global_unwind2
msvcrt.dll	266	_iob
msvcrt.dll	268	_isctype
msvcrt.dll	381	_msize
msvcrt.dll	383	_onexit
msvcrt.dll	387	_osver
msvcrt.dll	392	_pctype
msvcrt.dll	426	_setmode
msvcrt.dll	469	_tempnam
msvcrt.dll	494	_wchdir
msvcrt.dll	525	_wfindfirst
msvcrt.dll	528	_wfindnext
msvcrt.dll	531	_wfopen
msvcrt.dll	532	_wfreopen
msvcrt.dll	534	_wfullpath
msvcrt.dll	535	_wgetcwd
msvcrt.dll	537	_wgetenv
msvcrt.dll	538	_winmajor
msvcrt.dll	544	_wopen
msvcrt.dll	550	_wrename
msvcrt.dll	552	_wrmdir
msvcrt.dll	564	_wsplitpath
msvcrt.dll	577	_wunlink
msvcrt.dll	583	abort
msvcrt.dll	590	atexit
msvcrt.dll	592	atoi
msvcrt.dll	595	calloc
msvcrt.dll	597	clearerr
msvcrt.dll	604	exit
msvcrt.dll	607	fclose
msvcrt.dll	610	fflush
msvcrt.dll	611	fgetc
msvcrt.dll	613	fgets
msvcrt.dll	620	fputc
msvcrt.dll	624	fread
msvcrt.dll	625	free
msvcrt.dll	629	fseek
msvcrt.dll	633	fwrite
msvcrt.dll	637	getenv
msvcrt.dll	641	gmtime
msvcrt.dll	671	localeconv
msvcrt.dll	672	localtime
msvcrt.dll	676	malloc
msvcrt.dll	680	memchr
msvcrt.dll	681	memcmp
msvcrt.dll	682	memcpy
msvcrt.dll	683	memmove
msvcrt.dll	684	memset
msvcrt.dll	698	realloc
msvcrt.dll	701	rewind
msvcrt.dll	702	scanf
msvcrt.dll	705	setvbuf
msvcrt.dll	706	signal
msvcrt.dll	712	sscanf
msvcrt.dll	713	strcat
msvcrt.dll	717	strcpy
msvcrt.dll	719	strerror
msvcrt.dll	720	strftime
msvcrt.dll	721	strlen
msvcrt.dll	724	strncpy
msvcrt.dll	728	strstr
msvcrt.dll	734	swprintf
msvcrt.dll	739	time
msvcrt.dll	746	ungetc
msvcrt.dll	748	vfprintf
msvcrt.dll	754	wcscat
msvcrt.dll	755	wcschr
msvcrt.dll	756	wcscmp
msvcrt.dll	758	wcscpy
msvcrt.dll	761	wcslen
msvcrt.dll	764	wcsncpy
msvcrt.dll	766	wcsrchr
msvcrt.dll	768	wcsstr
SHELL32.DLL	2	CommandLineToArgvW
WS2_32.dll	26	WSACleanup
WS2_32.dll	43	WSAGetLastError
WS2_32.dll	79	WSASetLastError
WS2_32.dll	84	WSAStartup
WS2_32.dll	85	WSAStringToAddressA
WS2_32.dll	131	__WSAFDIsSet
WS2_32.dll	132	accept
WS2_32.dll	133	bind
WS2_32.dll	134	closesocket
WS2_32.dll	135	connect
WS2_32.dll	138	gethostbyaddr
WS2_32.dll	139	gethostbyname
WS2_32.dll	140	gethostname
WS2_32.dll	142	getpeername
WS2_32.dll	145	getservbyname
WS2_32.dll	146	getservbyport
WS2_32.dll	147	getsockname
WS2_32.dll	148	getsockopt
WS2_32.dll	155	ioctlsocket
WS2_32.dll	156	listen
WS2_32.dll	159	recv
WS2_32.dll	160	recvfrom
WS2_32.dll	161	select
WS2_32.dll	163	sendto
WS2_32.dll	164	setsockopt
WS2_32.dll	165	shutdown
WS2_32.dll	166	socket

show previews

offset	size	type	comment
0	1594880	EXE	10/19/2012 15:18:56	#
15c1	15	HTM		#
185600	364075	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x157d78