vimrun.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	vimrun.exe
size	68096 (0x10a00)
md5	208a0eeb724f7e55c39617a82d52456b

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xd0

Rich Header

lib id	version	times used
123	50727	3
1	0	93
132	30729	33
149	30729	9
131	30729	103
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	4
TimeDateStamp	0x4c69722e
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x23
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0xb600
SizeOfInitializedData	0x7200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1acc
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x15000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xb515	0xb600	R-X CODE
.rdata	0xd000	0x2f28	0x3000	R-- IDATA
.data	0x10000	0x36b8	0x1600	RW- IDATA
.pdata	0x14000	0x900	0xa00	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xf688	0x28
RESOURCE	0	0
EXCEPTION	0x14000	0x900
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xd000	0x288
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
KERNEL32.dll	855	ReadConsoleInputA
KERNEL32.dll	956	SetConsoleMode
KERNEL32.dll	406	GetConsoleMode
KERNEL32.dll	822	PeekConsoleInputA
KERNEL32.dll	529	GetNumberOfConsoleInputEvents
KERNEL32.dll	368	GetCommandLineA
KERNEL32.dll	486	GetLastError
KERNEL32.dll	673	HeapFree
KERNEL32.dll	121	CreateFileA
KERNEL32.dll	67	CloseHandle
KERNEL32.dll	669	HeapAlloc
KERNEL32.dll	918	RtlUnwindEx
KERNEL32.dll	191	DeleteCriticalSection
KERNEL32.dll	745	LeaveCriticalSection
KERNEL32.dll	218	EnterCriticalSection
KERNEL32.dll	1073	TerminateProcess
KERNEL32.dll	426	GetCurrentProcess
KERNEL32.dll	1090	UnhandledExceptionFilter
KERNEL32.dll	1049	SetUnhandledExceptionFilter
KERNEL32.dll	715	IsDebuggerPresent
KERNEL32.dll	919	RtlVirtualUnwind
KERNEL32.dll	912	RtlLookupFunctionEntry
KERNEL32.dll	905	RtlCaptureContext
KERNEL32.dll	1024	SetStdHandle
KERNEL32.dll	472	GetFileType
KERNEL32.dll	1169	WriteFile
KERNEL32.dll	1150	WideCharToMultiByte
KERNEL32.dll	388	GetConsoleCP
KERNEL32.dll	458	GetFileAttributesA
KERNEL32.dll	1004	SetHandleCount
KERNEL32.dll	571	GetStdHandle
KERNEL32.dll	569	GetStartupInfoA
KERNEL32.dll	505	GetModuleHandleW
KERNEL32.dll	1061	Sleep
KERNEL32.dll	544	GetProcAddress
KERNEL32.dll	261	ExitProcess
KERNEL32.dll	500	GetModuleFileNameA
KERNEL32.dll	331	FreeEnvironmentStringsA
KERNEL32.dll	448	GetEnvironmentStrings
KERNEL32.dll	332	FreeEnvironmentStringsW
KERNEL32.dll	450	GetEnvironmentStringsW
KERNEL32.dll	214	EncodePointer
KERNEL32.dll	184	DecodePointer
KERNEL32.dll	319	FlsGetValue
KERNEL32.dll	320	FlsSetValue
KERNEL32.dll	318	FlsFree
KERNEL32.dll	1008	SetLastError
KERNEL32.dll	430	GetCurrentThreadId
KERNEL32.dll	317	FlsAlloc
KERNEL32.dll	677	HeapSetInformation
KERNEL32.dll	671	HeapCreate
KERNEL32.dll	846	QueryPerformanceCounter
KERNEL32.dll	614	GetTickCount
KERNEL32.dll	427	GetCurrentProcessId
KERNEL32.dll	591	GetSystemTimeAsFileTime
KERNEL32.dll	1158	WriteConsoleA
KERNEL32.dll	410	GetConsoleOutputCP
KERNEL32.dll	1168	WriteConsoleW
KERNEL32.dll	788	MultiByteToWideChar
KERNEL32.dll	693	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	348	GetCPInfo
KERNEL32.dll	339	GetACP
KERNEL32.dll	531	GetOEMCP
KERNEL32.dll	725	IsValidCodePage
KERNEL32.dll	996	SetFilePointer
KERNEL32.dll	454	GetExitCodeProcess
KERNEL32.dll	1128	WaitForSingleObject
KERNEL32.dll	149	CreateProcessA
KERNEL32.dll	747	LoadLibraryA
KERNEL32.dll	676	HeapReAlloc
KERNEL32.dll	322	FlushFileBuffers
KERNEL32.dll	731	LCMapStringA
KERNEL32.dll	733	LCMapStringW
KERNEL32.dll	573	GetStringTypeA
KERNEL32.dll	576	GetStringTypeW
KERNEL32.dll	488	GetLocaleInfoA
KERNEL32.dll	82	CompareStringA
KERNEL32.dll	85	CompareStringW
KERNEL32.dll	981	SetEnvironmentVariableA
KERNEL32.dll	678	HeapSize

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	62512	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK