mpcgain.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	mpcgain.exe
size	159232 (0x26e00)
md5	321a8ab38dae5028d6b76af674580610

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe0

Rich Header

lib id	version	times used
132	30729	41
131	30729	127
149	30729	10
123	50727	3
1	0	92
131	21022	1
137	30729	11
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	5
TimeDateStamp	0x49d520e2
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x23
Magic	0x20b
LinkerVersion	9.0
SizeOfCode	0x1b800
SizeOfInitializedData	0xb200
SizeOfUninitializedData	0
AddressOfEntryPoint	0xbe10
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.2
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x62000
SizeOfHeaders	0x400
CheckSum	0x31b7e
Subsystem	3
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ 8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1b68f	0x1b800	R-X CODE
.rdata	0x1d000	0x6e82	0x7000	R-- IDATA
.data	0x24000	0x3b484	0x3000	RW- IDATA
.pdata	0x60000	0xe94	0x1000	R-- IDATA
.rsrc	0x61000	0x1b4	0x200	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x2367c	0x28
RESOURCE	0x61000	0x1b4
EXCEPTION	0x60000	0xe94
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x1d000	0x268
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	346	1252

module_name	hint	function_name
KERNEL32.dll	500	GetModuleFileNameA
KERNEL32.dll	486	GetLastError
KERNEL32.dll	673	HeapFree
KERNEL32.dll	669	HeapAlloc
KERNEL32.dll	218	EnterCriticalSection
KERNEL32.dll	745	LeaveCriticalSection
KERNEL32.dll	368	GetCommandLineA
KERNEL32.dll	505	GetModuleHandleW
KERNEL32.dll	1061	Sleep
KERNEL32.dll	544	GetProcAddress
KERNEL32.dll	261	ExitProcess
KERNEL32.dll	303	FindNextFileA
KERNEL32.dll	286	FindFirstFileA
KERNEL32.dll	282	FindClose
KERNEL32.dll	348	GetCPInfo
KERNEL32.dll	339	GetACP
KERNEL32.dll	531	GetOEMCP
KERNEL32.dll	725	IsValidCodePage
KERNEL32.dll	677	HeapSetInformation
KERNEL32.dll	671	HeapCreate
KERNEL32.dll	1169	WriteFile
KERNEL32.dll	571	GetStdHandle
KERNEL32.dll	1004	SetHandleCount
KERNEL32.dll	472	GetFileType
KERNEL32.dll	569	GetStartupInfoA
KERNEL32.dll	191	DeleteCriticalSection
KERNEL32.dll	918	RtlUnwindEx
KERNEL32.dll	1073	TerminateProcess
KERNEL32.dll	426	GetCurrentProcess
KERNEL32.dll	1090	UnhandledExceptionFilter
KERNEL32.dll	1049	SetUnhandledExceptionFilter
KERNEL32.dll	715	IsDebuggerPresent
KERNEL32.dll	919	RtlVirtualUnwind
KERNEL32.dll	912	RtlLookupFunctionEntry
KERNEL32.dll	905	RtlCaptureContext
KERNEL32.dll	788	MultiByteToWideChar
KERNEL32.dll	866	ReadFile
KERNEL32.dll	1150	WideCharToMultiByte
KERNEL32.dll	388	GetConsoleCP
KERNEL32.dll	406	GetConsoleMode
KERNEL32.dll	996	SetFilePointer
KERNEL32.dll	67	CloseHandle
KERNEL32.dll	331	FreeEnvironmentStringsA
KERNEL32.dll	448	GetEnvironmentStrings
KERNEL32.dll	332	FreeEnvironmentStringsW
KERNEL32.dll	450	GetEnvironmentStringsW
KERNEL32.dll	214	EncodePointer
KERNEL32.dll	184	DecodePointer
KERNEL32.dll	319	FlsGetValue
KERNEL32.dll	320	FlsSetValue
KERNEL32.dll	318	FlsFree
KERNEL32.dll	1008	SetLastError
KERNEL32.dll	430	GetCurrentThreadId
KERNEL32.dll	317	FlsAlloc
KERNEL32.dll	846	QueryPerformanceCounter
KERNEL32.dll	614	GetTickCount
KERNEL32.dll	427	GetCurrentProcessId
KERNEL32.dll	591	GetSystemTimeAsFileTime
KERNEL32.dll	747	LoadLibraryA
KERNEL32.dll	693	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	676	HeapReAlloc
KERNEL32.dll	731	LCMapStringA
KERNEL32.dll	733	LCMapStringW
KERNEL32.dll	573	GetStringTypeA
KERNEL32.dll	576	GetStringTypeW
KERNEL32.dll	322	FlushFileBuffers
KERNEL32.dll	121	CreateFileA
KERNEL32.dll	1024	SetStdHandle
KERNEL32.dll	1158	WriteConsoleA
KERNEL32.dll	410	GetConsoleOutputCP
KERNEL32.dll	1168	WriteConsoleW
KERNEL32.dll	852	RaiseException
KERNEL32.dll	678	HeapSize
KERNEL32.dll	488	GetLocaleInfoA
KERNEL32.dll	978	SetEndOfFile
KERNEL32.dll	547	GetProcessHeap

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	153648	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK