main.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	main.exe
size	1634304 (0x18f000)
md5	25ef96331029ebc179924a35248c3aa9

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
171	30319	2
156	30319	4
123	50727	5
1	0	76
170	30319	15
157	30319	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	5
TimeDateStamp	0x50afcd16
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	10.0
SizeOfCode	0x1a00
SizeOfInitializedData	0x18d200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2450
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x191000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1812	0x1a00	R-X CODE
.rdata	0x3000	0xe10	0x1000	R-- IDATA
.data	0x4000	0x18adc8	0x18ae00	RW- IDATA
.pdata	0x18f000	0x234	0x400	R-- IDATA
.reloc	0x190000	0xffc	0x1000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x35c4	0x64
RESOURCE	0	0
EXCEPTION	0x18f000	0x234
SECURITY	0	0
BASERELOC	0x190000	0x2c4
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x3000	0x280
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	function_name
USER32.dll	515	MessageBoxW
USER32.dll	508	MessageBoxA
python33.dll	896	Py_FrozenFlag
python33.dll	911	Py_IgnoreEnvironmentFlag
python33.dll	344	PyImport_FrozenModules
python33.dll	929	Py_SetPythonHome
python33.dll	430	PyMem_Malloc
python33.dll	928	Py_SetProgramName
python33.dll	904	Py_GetProgramFullPath
python33.dll	913	Py_Initialize
python33.dll	677	PySys_SetArgv
python33.dll	136	PyDict_New
python33.dll	194	PyEval_EvalCode
python33.dll	198	PyEval_GetBuiltins
python33.dll	139	PyDict_SetItemString
python33.dll	527	PyObject_CallMethod
python33.dll	376	PyList_Insert
python33.dll	796	PyUnicode_Decode
python33.dll	894	Py_FileSystemDefaultEncoding
python33.dll	770	PyUnicode_AsEncodedString
python33.dll	265	PyExc_SystemExit
python33.dll	151	PyErr_ExceptionMatches
python33.dll	673	PySys_GetObject
python33.dll	529	PyObject_CallObject
python33.dll	352	PyImport_ImportModule
python33.dll	856	PyUnicode_Join
python33.dll	546	PyObject_GetAttrString
python33.dll	149	PyErr_Clear
python33.dll	891	Py_Exit
python33.dll	386	PyLong_AsLong
python33.dll	572	PyObject_Str
python33.dll	152	PyErr_Fetch
python33.dll	159	PyErr_NormalizeException
python33.dll	797	PyUnicode_DecodeASCII
python33.dll	721	PyTuple_New
python33.dll	837	PyUnicode_Format
python33.dll	1173	_Py_NoneStruct
python33.dll	782	PyUnicode_AsUnicode
python33.dll	895	Py_Finalize
python33.dll	921	Py_NoSiteFlag
MSVCR100.dll	1444	mbstowcs
MSVCR100.dll	318	__argv
MSVCR100.dll	925	_onexit
MSVCR100.dll	758	_lock
MSVCR100.dll	328	__dllonexit
MSVCR100.dll	1115	_unlock
MSVCR100.dll	256	void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCR100.dll	377	__set_app_type
MSVCR100.dll	540	_fmode
MSVCR100.dll	452	_commode
MSVCR100.dll	380	__setusermatherr
MSVCR100.dll	453	_configthreadlocale
MSVCR100.dll	647	_initterm_e
MSVCR100.dll	646	_initterm
MSVCR100.dll	405	_acmdln
MSVCR100.dll	1352	exit
MSVCR100.dll	437	_cexit
MSVCR100.dll	677	_ismbblead
MSVCR100.dll	512	_exit
MSVCR100.dll	282	_XcptFilter
MSVCR100.dll	286	__C_specific_handler
MSVCR100.dll	338	__getmainargs
MSVCR100.dll	414	_amsg_exit
MSVCR100.dll	1479	setlocale
MSVCR100.dll	317	__argc
MSVCR100.dll	1578	wcstombs
KERNEL32.dll	573	GetStartupInfoW
KERNEL32.dll	215	EncodePointer
KERNEL32.dll	595	GetSystemTimeAsFileTime
KERNEL32.dll	428	GetCurrentProcessId
KERNEL32.dll	431	GetCurrentThreadId
KERNEL32.dll	618	GetTickCount
KERNEL32.dll	851	QueryPerformanceCounter
KERNEL32.dll	185	DecodePointer
KERNEL32.dll	1059	SetUnhandledExceptionFilter
KERNEL32.dll	1071	Sleep

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	1628720	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK