cmd.exe-winx - Cmd.Exe - Windows Command Processor

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	cmd.exe-winx
size	200704 (0x31000)
md5	42fefca6ab3edfb9aee8b87292e47dfe

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
147	30729	58
243	40116	2
241	40116	6
242	40116	22
1	0	263
239	40116	5
251	40116	38
237	40116	1
240	40116	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x559f3b1b
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	12.10
SizeOfCode	0x24000
SizeOfInitializedData	0x28800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x134b0
BaseOfCode	0x1000
BaseOfData	0x25000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	10.0
ImageVersion	10.0
SubsystemVersion	10.0
Reserved1	0
SizeOfImage	0x50000
SizeOfHeaders	0x400
CheckSum	0x37c0c
Subsystem	3
DllCharacteristics	0xc140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0xfd000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x23e4c	0x24000	R-X CODE
.data	0x25000	0x1bc4c	0x200	RW- IDATA
.idata	0x41000	0x2004	0x2200	R-- IDATA
.didat	0x44000	0x40	0x200	RW- IDATA
.rsrc	0x45000	0x8448	0x8600	R-- IDATA
.reloc	0x4e000	0x1f7c	0x2000	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x41434	0x280
RESOURCE	0x45000	0x8448
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x4e000	0x1f7c
DEBUG	0x1ac0	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x1b18	0x68
Bound_IAT	0	0
IAT	0x41000	0x430
Delay_IAT	0x24c14	0x60
CLR_Header	0	0

show previews

type	name	size
MUI	#1	216
ICON	#1	1640
ICON	#2	744
ICON	#3	296
ICON	#4	3752
ICON	#5	2216
ICON	#6	1384
ICON	#7	5790
ICON	#8	9640
ICON	#9	4264
ICON	#10	1128
GROUP_ICON	IDI_APPICON	146
VERSION	#1	896
MANIFEST	#1	896

module_name	hint	function_name
msvcrt.dll	206	__p__fmode
msvcrt.dll	292	_cexit
msvcrt.dll	371	_exit
msvcrt.dll	226	__set_app_type
msvcrt.dll	161	__getmainargs
msvcrt.dll	273	_amsg_exit
msvcrt.dll	201	__p__commode
msvcrt.dll	111	_XcptFilter
msvcrt.dll	1410	wcsspn
msvcrt.dll	1221	free
msvcrt.dll	1305	qsort
msvcrt.dll	352	_dup2
msvcrt.dll	351	_dup
msvcrt.dll	307	_close
msvcrt.dll	779	_open_osfhandle
msvcrt.dll	1358	swscanf
msvcrt.dll	954	_ultoa
msvcrt.dll	788	_pipe
msvcrt.dll	1402	wcsncmp
msvcrt.dll	842	_setmode
msvcrt.dll	228	__setusermatherr
msvcrt.dll	488	_initterm
msvcrt.dll	53	void __cdecl terminate(void) ?terminate@@YAXXZ
msvcrt.dll	1267	iswxdigit
msvcrt.dll	1363	time
msvcrt.dll	456	_getch
msvcrt.dll	1289	memcpy
msvcrt.dll	1325	srand
msvcrt.dll	1164	_wtol
msvcrt.dll	1204	fflush
msvcrt.dll	1411	wcsstr
msvcrt.dll	1256	iswalpha
msvcrt.dll	1288	memcmp
msvcrt.dll	1418	wcstoul
msvcrt.dll	359	_errno
msvcrt.dll	1298	printf
msvcrt.dll	1308	rand
msvcrt.dll	839	_setjmp3
msvcrt.dll	1214	fprintf
msvcrt.dll	603	_local_unwind4
msvcrt.dll	311	_controlfp
msvcrt.dll	1407	wcsrchr
msvcrt.dll	1310	realloc
msvcrt.dll	935	_tell
msvcrt.dll	1370	towlower
msvcrt.dll	1317	setlocale
msvcrt.dll	1065	_wcsupr
msvcrt.dll	1260	iswdigit
msvcrt.dll	362	_except_handler4_common
msvcrt.dll	1037	_wcsicmp
msvcrt.dll	1265	iswspace
msvcrt.dll	1392	wcschr
msvcrt.dll	1198	exit
msvcrt.dll	163	__iob_func
msvcrt.dll	1291	memmove
msvcrt.dll	1047	_wcsnicmp
msvcrt.dll	1207	fgets
msvcrt.dll	1004	_vsnwprintf
msvcrt.dll	785	_pclose
msvcrt.dll	1203	ferror
msvcrt.dll	1202	feof
msvcrt.dll	1415	wcstol
msvcrt.dll	1276	longjmp
msvcrt.dll	445	_get_osfhandle
msvcrt.dll	1041	_wcslwr
msvcrt.dll	1188	calloc
msvcrt.dll	1371	towupper
msvcrt.dll	1118	_wpopen
msvcrt.dll	1293	memset
ntdll.dll	936	RtlFreeHeap
ntdll.dll	407	NtOpenThreadToken
ntdll.dll	238	NtClose
ntdll.dll	399	NtOpenProcessToken
ntdll.dll	445	NtQueryInformationToken
ntdll.dll	337	NtFsControlFile
ntdll.dll	850	RtlDosPathNameToNtPathName_U
ntdll.dll	916	RtlFindLeastSignificantBit
ntdll.dll	941	RtlFreeUnicodeString
ntdll.dll	1243	RtlReleaseRelativeName
ntdll.dll	386	NtOpenFile
ntdll.dll	853	RtlDosPathNameToRelativeNtPathName_U_WithStatus
ntdll.dll	542	NtSetInformationFile
ntdll.dll	476	NtQueryVolumeInformationFile
ntdll.dll	546	NtSetInformationProcess
ntdll.dll	442	NtQueryInformationProcess
ntdll.dll	1160	RtlNtStatusToDosError
ntdll.dll	233	NtCancelSynchronousIoFile
ntdll.dll	793	RtlCreateUnicodeStringFromAsciiz
api-ms-win-core-kernel32-legacy-l1-1-1.dll	5	CopyFileW
api-ms-win-core-memory-l1-1-2.dll	37	VirtualFree
api-ms-win-core-memory-l1-1-2.dll	23	ReadProcessMemory
api-ms-win-core-memory-l1-1-2.dll	43	VirtualQuery
api-ms-win-core-memory-l1-1-2.dll	33	VirtualAlloc
api-ms-win-core-localization-l1-2-1.dll	10	GetCPInfo
api-ms-win-core-localization-l1-2-1.dll	9	GetACP
api-ms-win-core-localization-l1-2-1.dll	19	GetLocaleInfoW
api-ms-win-core-localization-l1-2-1.dll	28	GetThreadLocale
api-ms-win-core-localization-l1-2-1.dll	32	GetUserDefaultLCID
api-ms-win-core-localization-l1-2-1.dll	56	SetThreadLocale
api-ms-win-core-localization-l1-2-1.dll	8	FormatMessageW
api-ms-win-core-console-l1-1-0.dll	11	SetConsoleMode
api-ms-win-core-console-l1-1-0.dll	13	WriteConsoleW
api-ms-win-core-console-l1-1-0.dll	9	ReadConsoleW
api-ms-win-core-console-l1-1-0.dll	3	GetConsoleOutputCP
api-ms-win-core-console-l1-1-0.dll	2	GetConsoleMode
api-ms-win-core-console-l1-1-0.dll	10	SetConsoleCtrlHandler
api-ms-win-core-libraryloader-l1-2-0.dll	23	LoadLibraryExW
api-ms-win-core-libraryloader-l1-2-0.dll	15	GetModuleFileNameW
api-ms-win-core-libraryloader-l1-2-0.dll	16	GetModuleHandleA
api-ms-win-core-libraryloader-l1-2-0.dll	19	GetModuleHandleW
api-ms-win-core-libraryloader-l1-2-0.dll	20	GetProcAddress
api-ms-win-core-file-l1-2-1.dll	26	FindNextFileW
api-ms-win-core-file-l1-2-1.dll	65	GetVolumePathNameW
api-ms-win-core-file-l1-2-1.dll	18	FindFirstFileExW
api-ms-win-core-file-l1-2-1.dll	35	GetDiskFreeSpaceExW
api-ms-win-core-file-l1-2-1.dll	20	FindFirstFileW
api-ms-win-core-file-l1-2-1.dll	1	CompareFileTime
api-ms-win-core-file-l1-2-1.dll	75	RemoveDirectoryW
api-ms-win-core-file-l1-2-1.dll	12	FindClose
api-ms-win-core-file-l1-2-1.dll	83	SetFilePointer
api-ms-win-core-file-l1-2-1.dll	6	CreateFileW
api-ms-win-core-file-l1-2-1.dll	11	FileTimeToLocalFileTime
api-ms-win-core-file-l1-2-1.dll	71	ReadFile
api-ms-win-core-file-l1-2-1.dll	85	SetFileTime
api-ms-win-core-file-l1-2-1.dll	9	DeleteFileW
api-ms-win-core-file-l1-2-1.dll	76	SetEndOfFile
api-ms-win-core-file-l1-2-1.dll	80	SetFileAttributesW
api-ms-win-core-file-l1-2-1.dll	3	CreateDirectoryW
api-ms-win-core-file-l1-2-1.dll	44	GetFileSize
api-ms-win-core-file-l1-2-1.dll	42	GetFileAttributesW
api-ms-win-core-file-l1-2-1.dll	47	GetFileType
api-ms-win-core-file-l1-2-1.dll	89	WriteFile
api-ms-win-core-file-l1-2-1.dll	30	FlushFileBuffers
api-ms-win-core-file-l1-2-1.dll	63	GetVolumeInformationW
api-ms-win-core-file-l1-2-1.dll	38	GetDriveTypeW
api-ms-win-core-file-l1-2-1.dll	41	GetFileAttributesExW
api-ms-win-core-file-l1-2-1.dll	51	GetFullPathNameW
api-ms-win-core-file-l1-2-1.dll	84	SetFilePointerEx
api-ms-win-core-errorhandling-l1-1-1.dll	12	SetErrorMode
api-ms-win-core-errorhandling-l1-1-1.dll	15	SetUnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll	17	UnhandledExceptionFilter
api-ms-win-core-errorhandling-l1-1-1.dll	5	GetLastError
api-ms-win-core-errorhandling-l1-1-1.dll	13	SetLastError
api-ms-win-core-handle-l1-1-0.dll	2	DuplicateHandle
api-ms-win-core-handle-l1-1-0.dll		CloseHandle
api-ms-win-core-string-l1-1-0.dll	7	WideCharToMultiByte
api-ms-win-core-string-l1-1-0.dll	6	MultiByteToWideChar
api-ms-win-core-processenvironment-l1-2-0.dll	3	FreeEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll	12	GetStdHandle
api-ms-win-core-processenvironment-l1-2-0.dll	21	SetEnvironmentVariableW
api-ms-win-core-processenvironment-l1-2-0.dll	18	SetCurrentDirectoryW
api-ms-win-core-processenvironment-l1-2-0.dll	5	GetCommandLineW
api-ms-win-core-processenvironment-l1-2-0.dll	16	SearchPathW
api-ms-win-core-processenvironment-l1-2-0.dll	9	GetEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll	1	ExpandEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll	14	NeedCurrentDirectoryForExePathW
api-ms-win-core-processenvironment-l1-2-0.dll	19	SetEnvironmentStringsW
api-ms-win-core-processenvironment-l1-2-0.dll	7	GetCurrentDirectoryW
api-ms-win-core-processenvironment-l1-2-0.dll	11	GetEnvironmentVariableW
api-ms-win-core-console-l2-1-0.dll	11	GetConsoleTitleW
api-ms-win-core-console-l2-1-0.dll	4	FillConsoleOutputCharacterW
api-ms-win-core-console-l2-1-0.dll	9	GetConsoleScreenBufferInfo
api-ms-win-core-console-l2-1-0.dll	5	FlushConsoleInputBuffer
api-ms-win-core-console-l2-1-0.dll	29	SetConsoleTitleW
api-ms-win-core-console-l2-1-0.dll	24	SetConsoleCursorPosition
api-ms-win-core-console-l2-1-0.dll	20	ScrollConsoleScreenBufferW
api-ms-win-core-console-l2-1-0.dll	2	FillConsoleOutputAttribute
api-ms-win-core-console-l2-1-0.dll	28	SetConsoleTextAttribute
api-ms-win-core-heap-l1-2-0.dll	10	HeapSetInformation
api-ms-win-core-heap-l1-2-0.dll	2	HeapAlloc
api-ms-win-core-heap-l1-2-0.dll	9	HeapReAlloc
api-ms-win-core-heap-l1-2-0.dll		GetProcessHeap
api-ms-win-core-heap-l1-2-0.dll	6	HeapFree
api-ms-win-core-heap-l1-2-0.dll	11	HeapSize
api-ms-win-security-base-l1-2-0.dll	87	RevertToSelf
api-ms-win-security-base-l1-2-0.dll	57	GetSecurityDescriptorOwner
api-ms-win-security-base-l1-2-0.dll	49	GetFileSecurityW
api-ms-win-core-synch-l1-2-0.dll	37	ReleaseSRWLockShared
api-ms-win-core-synch-l1-2-0.dll	36	ReleaseSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll	1	AcquireSRWLockShared
api-ms-win-core-synch-l1-2-0.dll	29	LeaveCriticalSection
api-ms-win-core-synch-l1-2-0.dll	54	WaitForSingleObject
api-ms-win-core-synch-l1-2-0.dll	45	Sleep
api-ms-win-core-synch-l1-2-0.dll	17	EnterCriticalSection
api-ms-win-core-synch-l1-2-0.dll	49	TryAcquireSRWLockExclusive
api-ms-win-core-synch-l1-2-0.dll	24	InitializeCriticalSection
api-ms-win-core-sysinfo-l1-2-1.dll	20	GetSystemTimeAsFileTime
api-ms-win-core-sysinfo-l1-2-1.dll	24	GetTickCount
api-ms-win-core-sysinfo-l1-2-1.dll	5	GetLocalTime
api-ms-win-core-sysinfo-l1-2-1.dll	26	GetVersion
api-ms-win-core-sysinfo-l1-2-1.dll	30	GetWindowsDirectoryW
api-ms-win-core-sysinfo-l1-2-1.dll	38	SetLocalTime
api-ms-win-core-sysinfo-l1-2-1.dll	18	GetSystemTime
api-ms-win-core-timezone-l1-1-0.dll	8	SystemTimeToFileTime
api-ms-win-core-timezone-l1-1-0.dll	1	FileTimeToSystemTime
api-ms-win-core-datetime-l1-1-1.dll	6	GetTimeFormatW
api-ms-win-core-datetime-l1-1-1.dll	2	GetDateFormatW
api-ms-win-core-systemtopology-l1-1-0.dll	1	GetNumaNodeProcessorMaskEx
api-ms-win-core-systemtopology-l1-1-0.dll		GetNumaHighestNodeNumber
api-ms-win-core-processthreads-l1-1-2.dll	44	InitializeProcThreadAttributeList
api-ms-win-core-processthreads-l1-1-2.dll	32	GetStartupInfoW
api-ms-win-core-processthreads-l1-1-2.dll	2	CreateProcessAsUserW
api-ms-win-core-processthreads-l1-1-2.dll	3	CreateProcessW
api-ms-win-core-processthreads-l1-1-2.dll	49	OpenThread
api-ms-win-core-processthreads-l1-1-2.dll	17	GetCurrentThreadId
api-ms-win-core-processthreads-l1-1-2.dll	75	TerminateProcess
api-ms-win-core-processthreads-l1-1-2.dll	19	GetExitCodeProcess
api-ms-win-core-processthreads-l1-1-2.dll	55	ResumeThread
api-ms-win-core-processthreads-l1-1-2.dll	12	GetCurrentProcess
api-ms-win-core-processthreads-l1-1-2.dll	13	GetCurrentProcessId
api-ms-win-core-processthreads-l1-1-2.dll	81	UpdateProcThreadAttribute
api-ms-win-core-processthreads-l1-1-2.dll	7	DeleteProcThreadAttributeList
api-ms-win-core-registry-l1-1-0.dll	3	RegCreateKeyExW
api-ms-win-core-registry-l1-1-0.dll	11	RegDeleteValueW
api-ms-win-core-registry-l1-1-0.dll	5	RegDeleteKeyExW
api-ms-win-core-registry-l1-1-0.dll	44	RegSetValueExW
api-ms-win-core-registry-l1-1-0.dll	14	RegEnumKeyExW
api-ms-win-core-registry-l1-1-0.dll	35	RegQueryValueExW
api-ms-win-core-registry-l1-1-0.dll		RegCloseKey
api-ms-win-core-registry-l1-1-0.dll	30	RegOpenKeyExW
api-ms-win-core-file-l2-1-1.dll	6	CreateSymbolicLinkW
api-ms-win-core-file-l2-1-1.dll	7	GetFileInformationByHandleEx
api-ms-win-core-file-l2-1-1.dll	9	MoveFileWithProgressW
api-ms-win-core-file-l2-1-1.dll	8	MoveFileExW
api-ms-win-core-file-l2-1-1.dll	5	CreateHardLinkW
api-ms-win-core-heap-l2-1-0.dll	3	LocalFree
api-ms-win-core-heap-l2-1-0.dll	1	GlobalFree
api-ms-win-core-heap-l2-1-0.dll		GlobalAlloc
api-ms-win-core-io-l1-1-1.dll	4	DeviceIoControl
api-ms-win-core-processtopology-l1-2-0.dll	1	GetThreadGroupAffinity
api-ms-win-core-profile-l1-1-0.dll		QueryPerformanceCounter
api-ms-win-core-string-obsolete-l1-1-0.dll	3	lstrcmpW
api-ms-win-core-string-obsolete-l1-1-0.dll	5	lstrcmpiW
api-ms-win-core-processtopology-obsolete-l1-1-0.dll	3	SetProcessAffinityMask
api-ms-win-core-apiquery-l1-1-0.dll		ApiSetQueryApiSetPresence
api-ms-win-core-delayload-l1-1-1.dll	1	ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-1.dll		DelayLoadFailureHook

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Windows Command Processor
FileVersion	10.0.10240.16384 (th1.150709-1700)
InternalName	cmd
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	Cmd.Exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	10.0.10240.16384

VS_FIXEDFILEINFO

FileVersion	10.0.10240.16384
ProductVersion	10.0.10240.16384
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	200704	EXE	07/10/2015 03:25:15	#
15c1	15	HTM		#
29800	5790	PNG	(256 x 256)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

cmd.exe-winx-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

cmd.exe-winx
-