filenamemapedit.exe
size167424 (0x28e00)
md52daf73f521a1e68ed2eadcf98fe564b5
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1473072914
257289203
2612892028
2602892012
259289203
2572671510
10140
2652911164
255291111
258291111

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5f7322f1
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.27
SizeOfCode0x1fe00
SizeOfInitializedData0x7f000
SizeOfUninitializedData0
AddressOfEntryPoint0x1fc62
BaseOfCode0x1000
BaseOfData0x21000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xa2000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x1fc100x1fe00R-X CODE
.rdata0x210000x44260x4600R-- IDATA
.data0x260000x77c4c0x1a00RW- IDATA
.rsrc0x9e0000x1e00x200R-- IDATA
.reloc0x9f0000x281c0x2a00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x246bc0x118
RESOURCE0x9e0000x1e0
EXCEPTION00
SECURITY00
BASERELOC0x9f0000x281c
DEBUG0x236000x70
ARCHITECTURE00
GLOBALPTR00
TLS0x237280x18
LOAD_CONFIG0x236700x40
Bound_IAT00
IAT0x210000x228
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x42441c0x4244240x427ce00x42130000x300000
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
VCRUNTIME140.dll33__std_exception_copy
VCRUNTIME140.dll34__std_exception_destroy
VCRUNTIME140.dll1_CxxThrowException
VCRUNTIME140.dll28__current_exception
VCRUNTIME140.dll35__std_terminate
VCRUNTIME140.dll72memset
VCRUNTIME140.dll53_except_handler4_common
VCRUNTIME140.dll70memcpy
VCRUNTIME140.dll29__current_exception_context
VCRUNTIME140.dll16__CxxFrameHandler3
VCRUNTIME140.dll61_purecall
VCRUNTIME140.dll71memmove
api-ms-win-crt-heap-l1-1-0.dll26realloc
api-ms-win-crt-heap-l1-1-0.dll24free
api-ms-win-crt-heap-l1-1-0.dll25malloc
api-ms-win-crt-heap-l1-1-0.dll8_callnewh
api-ms-win-crt-heap-l1-1-0.dll22_set_new_mode
api-ms-win-crt-utility-l1-1-0.dll25qsort
api-ms-win-crt-runtime-l1-1-0.dll22_c_exit
api-ms-win-crt-runtime-l1-1-0.dll63_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll106terminate
api-ms-win-crt-runtime-l1-1-0.dll37_exit
api-ms-win-crt-runtime-l1-1-0.dll57_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll56_initterm
api-ms-win-crt-runtime-l1-1-0.dll45_get_narrow_winmain_command_line
api-ms-win-crt-runtime-l1-1-0.dll29_controlfp_s
api-ms-win-crt-runtime-l1-1-0.dll66_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll23_cexit
api-ms-win-crt-runtime-l1-1-0.dll31_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll68_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll62_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll54_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll53_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll25_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll88exit
api-ms-win-crt-time-l1-1-0.dll69clock
api-ms-win-crt-math-l1-1-0.dll46__setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll1__p__commode
api-ms-win-crt-stdio-l1-1-0.dll84_set_fmode
api-ms-win-crt-locale-l1-1-0.dll8_configthreadlocale
KERNEL32.dll895IsDebuggerPresent
KERNEL32.dll902IsProcessorFeaturePresent
KERNEL32.dll1420TerminateProcess
KERNEL32.dll1101QueryPerformanceCounter
KERNEL32.dll1389SetUnhandledExceptionFilter
KERNEL32.dll1453UnhandledExceptionFilter
KERNEL32.dll686GetProcAddress
KERNEL32.dll632GetModuleHandleW
KERNEL32.dll536GetCurrentProcessId
KERNEL32.dll540GetCurrentThreadId
KERNEL32.dll745GetSystemTimeAsFileTime
KERNEL32.dll867InitializeSListHead
KERNEL32.dll720GetStartupInfoW
KERNEL32.dll535GetCurrentProcess
KERNEL32.dll1222ResetEvent
KERNEL32.dll191CreateEventW
KERNEL32.dll1496WaitForSingleObjectEx
KERNEL32.dll1302SetEvent
KERNEL32.dll272DeleteCriticalSection
KERNEL32.dll863InitializeCriticalSectionAndSpinCount
KERNEL32.dll957LeaveCriticalSection
KERNEL32.dll305EnterCriticalSection
KERNEL32.dll831GlobalUnlock
KERNEL32.dll824GlobalLock
KERNEL32.dll813GlobalAlloc
KERNEL32.dll828GlobalSize
KERNEL32.dll610GetLocalTime
KERNEL32.dll629GetModuleHandleA
KERNEL32.dll134CloseHandle
KERNEL32.dll195CreateFileA
KERNEL32.dll373FindClose
KERNEL32.dll1314SetFilePointer
KERNEL32.dll394FindNextFileA
KERNEL32.dll1554WriteFile
KERNEL32.dll377FindFirstFileA
KERNEL32.dll1139ReadFile
USER32.dll725RegisterClassA
USER32.dll883SetWindowTextA
USER32.dll921TrackMouseEvent
USER32.dll483GetWindowLongA
USER32.dll896ShowWindow
USER32.dll489GetWindowPlacement
USER32.dll452GetSystemMetrics
USER32.dll770ScreenToClient
USER32.dll680PostMessageA
USER32.dll583IsWindowVisible
USER32.dll591LoadCursorA
USER32.dll491GetWindowRect
USER32.dll188DispatchMessageA
USER32.dll387GetMessageA
USER32.dll358GetKeyState
USER32.dll4AdjustWindowRectEx
USER32.dll552IsClipboardFormatAvailable
USER32.dll166DefWindowProcA
USER32.dll308GetClipboardData
USER32.dll232EmptyClipboard
USER32.dll79CloseClipboard
USER32.dll595LoadIconA
USER32.dll663OpenClipboard
USER32.dll305GetClientRect
USER32.dll117CreateWindowExA
USER32.dll928TranslateMessage
USER32.dll296GetClassInfoA
USER32.dll676PeekMessageA
USER32.dll682PostQuitMessage
USER32.dll954UpdateWindow
USER32.dll540InvalidateRect
USER32.dll319GetCursorPos
USER32.dll114CreatePopupMenu
USER32.dll77ClientToScreen
USER32.dll178DestroyMenu
USER32.dll923TrackPopupMenuEx
USER32.dll795SetClipboardData
USER32.dll780SendMessageA
USER32.dll282GetActiveWindow
USER32.dll534InsertMenuItemA
USER32.dll381GetMenuItemInfoA
USER32.dll11AppendMenuA
USER32.dll799SetCursor
GDI32.dll878SetDIBitsToDevice
GDI32.dll921StretchDIBits
COMDLG32.dll11GetOpenFileNameA
COMDLG32.dllChooseColorA
SHELL32.dll134SHBrowseForFolderA
SHELL32.dll362SHGetPathFromIDListA
offsetsizetypecomment
0167424EXE09/29/2020 12:05:05#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x27ce0