filenamenanogg-cli.exe
size183808 (0x2ce00)
md525e2626bd42b1044dd6acc1e02caeffd
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x51ed7e99
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion2.50
SizeOfCode0x1cc00
SizeOfInitializedData0x10200
SizeOfUninitializedData0
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x1f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x31000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

PureBasic 4.x (Neil Hodgson)

Sections

namevavsizeraw sizeflags
.code0x10000x1120x200R-X CODE
.text0x20000x1c9a50x1ca00R-X CODE
.rdata0x1f0000x7980x800R-- IDATA
.data0x200000xf5540xf200RW- IDATA
.rsrc0x300000x2bc0x400R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x2e9d40xa0
RESOURCE0x300000x2bc
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x2ebc00x14c
Delay_IAT00
CLR_Header00
typenamesizecp
MANIFEST#16110
module_namehintordfunction_name
MSVCRT.dll665memset
MSVCRT.dll605fread
MSVCRT.dll588fclose
MSVCRT.dll612ftell
MSVCRT.dll610fseek
MSVCRT.dll663memcpy
MSVCRT.dll655log10
MSVCRT.dll599fopen
MSVCRT.dll705strncpy
MSVCRT.dll200_errno
MSVCRT.dll679realloc
MSVCRT.dll657malloc
MSVCRT.dll606free
MSVCRT.dll576calloc
MSVCRT.dll597floor
MSVCRT.dll724toupper
MSVCRT.dll664memmove
MSVCRT.dll690sprintf
MSVCRT.dll668perror
MSVCRT.dll51_CIatan
MSVCRT.dll600fprintf
MSVCRT.dll57_CIlog
MSVCRT.dll650ldexp
MSVCRT.dll59_CIpow
MSVCRT.dll676qsort
MSVCRT.dll55_CIexp
MSVCRT.dll577ceil
MSVCRT.dll62_CIsqrt
MSVCRT.dll53_CIcos
MSVCRT.dll60_CIsin
MSVCRT.dll585exit
MSVCRT.dll608frexp
MSVCRT.dll49_CIacos
MSVCRT.dll661memchr
MSVCRT.dll73__CxxFrameHandler
KERNEL32.dll503GetModuleHandleA
KERNEL32.dll676HeapCreate
KERNEL32.dll677HeapDestroy
KERNEL32.dll261ExitProcess
KERNEL32.dll674HeapAlloc
KERNEL32.dll678HeapFree
KERNEL32.dll974SetCurrentDirectoryA
KERNEL32.dll758LoadLibraryA
KERNEL32.dll546GetProcAddress
KERNEL32.dll121CreateFileA
KERNEL32.dll469GetFileSize
KERNEL32.dll878ReadFile
KERNEL32.dll68CloseHandle
KERNEL32.dll1067Sleep
KERNEL32.dll164CreateThread
KERNEL32.dll333FreeLibrary
KERNEL32.dll430GetCurrentThreadId
KERNEL32.dll427GetCurrentProcessId
KERNEL32.dll697InitializeCriticalSection
KERNEL32.dll368GetCommandLineA
KERNEL32.dll681HeapReAlloc
USER32.DLLBeginPaint
USER32.DLLEndPaint
USER32.DLLDefWindowProcA
USER32.DLLLoadIconA
USER32.DLLRegisterClassExA
USER32.DLLCreateWindowExA
USER32.DLLMessageBoxA
USER32.DLLGetWindowThreadProcessId
USER32.DLLIsWindowVisible
USER32.DLLGetWindowLongA
USER32.DLLGetForegroundWindow
USER32.DLLIsWindowEnabled
USER32.DLLEnableWindow
USER32.DLLEnumWindows
USER32.DLLSetWindowPos
GDI32.DLLGetStockObject
COMCTL32.DLLInitCommonControlsEx
OLE32.DLLCoInitialize
WINMM.DLLtimeBeginPeriod
WINMM.DLLtimeEndPeriod
offsetsizetypecomment
0183808EXE07/22/2013 18:48:57#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK