x.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	x.exe
size	289326 (0x46a2e)
md5	63ed09c5f8af9b9a0fe2fac6e232d874

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0x11
TimeDateStamp	0x602be178
PointerToSymbolTable	0x3c200
NumberOfSymbols	0x7c8
SizeOfOptionalHeader	0xf0
Characteristics	0x27
Magic	0x20b
LinkerVersion	2.35
SizeOfCode	0x7000
SizeOfInitializedData	0x9c00
SizeOfUninitializedData	0xc00
AddressOfEntryPoint	0x14e0
BaseOfCode	0x1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x46000
SizeOfHeaders	0x600
CheckSum	0x4a2cd
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6e48	0x7000	R-X CODE IDATA
.data	0x8000	0xf0	0x200	RW- IDATA
.rdata	0x9000	0xe80	0x1000	R-- IDATA
.pdata	0xa000	0x4a4	0x600	R-- IDATA
.xdata	0xb000	0x44c	0x600	R-- IDATA
.bss	0xc000	0xbe0	0	RW- UDATA
.idata	0xd000	0x840	0xa00	RW- IDATA
.CRT	0xe000	0x68	0x200	RW- IDATA
.tls	0xf000	0x10	0x200	RW- IDATA
/4	0x10000	0x680	0x800	R-- IDATA DISCARDABLE
/19	0x11000	0x11c91	0x11e00	R-- IDATA DISCARDABLE
/31	0x23000	0x301e	0x3200	R-- IDATA DISCARDABLE
/45	0x27000	0x745a	0x7600	R-- IDATA DISCARDABLE
/57	0x2f000	0x1718	0x1800	R-- IDATA DISCARDABLE
/70	0x31000	0x800	0x800	R-- IDATA DISCARDABLE
/81	0x32000	0x11adc	0x11c00	R-- IDATA DISCARDABLE
/92	0x44000	0x1540	0x1600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xd000	0x840
RESOURCE	0	0
EXCEPTION	0xa000	0x4a4
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x9120	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0xd220	0x1d0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x40f000	0x40f008	0x40c0cc	0x40e040	0	0

module_name	hint	function_name
ADVAPI32.dll	1689	RegisterServiceCtrlHandlerA
ADVAPI32.dll	1756	SetServiceStatus
ADVAPI32.dll	1763	StartServiceCtrlDispatcherA
KERNEL32.dll	283	DeleteCriticalSection
KERNEL32.dll	319	EnterCriticalSection
KERNEL32.dll	630	GetLastError
KERNEL32.dll	710	GetProcAddress
KERNEL32.dll	743	GetStartupInfoA
KERNEL32.dll	892	InitializeCriticalSection
KERNEL32.dll	919	IsDBCSLeadByteEx
KERNEL32.dll	984	LeaveCriticalSection
KERNEL32.dll	988	LoadLibraryA
KERNEL32.dll	1036	MultiByteToWideChar
KERNEL32.dll	1394	SetUnhandledExceptionFilter
KERNEL32.dll	1410	Sleep
KERNEL32.dll	1445	TlsGetValue
KERNEL32.dll	1492	VirtualProtect
KERNEL32.dll	1494	VirtualQuery
KERNEL32.dll	1547	WideCharToMultiByte
msvcrt.dll	56	__C_specific_handler
msvcrt.dll	64	___lc_codepage_func
msvcrt.dll	67	___mb_cur_max_func
msvcrt.dll	82	__getmainargs
msvcrt.dll	83	__initenv
msvcrt.dll	84	__iob_func
msvcrt.dll	91	__lconv_init
msvcrt.dll	97	__set_app_type
msvcrt.dll	99	__setusermatherr
msvcrt.dll	114	_acmdln
msvcrt.dll	121	_amsg_exit
msvcrt.dll	139	_cexit
msvcrt.dll	151	_commode
msvcrt.dll	190	_errno
msvcrt.dll	220	_fmode
msvcrt.dll	285	_initterm
msvcrt.dll	387	_lock
msvcrt.dll	553	_onexit
msvcrt.dll	714	_unlock
msvcrt.dll	906	abort
msvcrt.dll	923	calloc
msvcrt.dll	936	exit
msvcrt.dll	956	fprintf
msvcrt.dll	958	fputc
msvcrt.dll	963	free
msvcrt.dll	976	fwrite
msvcrt.dll	1017	localeconv
msvcrt.dll	1023	malloc
msvcrt.dll	1031	memcpy
msvcrt.dll	1033	memset
msvcrt.dll	1063	signal
msvcrt.dll	1084	strerror
msvcrt.dll	1086	strlen
msvcrt.dll	1089	strncmp
msvcrt.dll	1123	vfprintf
msvcrt.dll	1149	wcslen

show previews

offset	size	type	comment
0	289326	EXE	02/16/2021 15:15:04	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0xc0cc