ldr.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	ldr.exe
size	7712784 (0x75b010)
md5	6b0f82dfa4841ae06458178219430248

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x78
blocks_in_file	1
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0
ss	0
sp	0
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x78

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 24 00 00                           |mode.$..        |

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0x11
TimeDateStamp	0x5ff48bbf
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.0
SizeOfCode	0x11cc00
SizeOfInitializedData	0x87400
SizeOfUninitializedData	0
AddressOfEntryPoint	0xd87058
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x141e000
SizeOfHeaders	0x600
CheckSum	0x76360a
Subsystem	2
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
	0x1000	0x11cbf6	0x7b200	R-X CODE
	0x11e000	0x4eed4	0x20c00	R-- IDATA
	0x16d000	0x16198	0x2600	RW- IDATA
	0x184000	0xc198	0x7000	R-- IDATA
	0x191000	0x28	0x200	R-- IDATA
	0x192000	0x60	0x200	R-- IDATA
	0x193000	0x1d	0x200	RW- IDATA
	0x194000	0x94	0x200	R-- IDATA
	0x195000	4	0x200	RW- IDATA
	0x196000	0x19ac8	0x4200	R-- IDATA
	0x1b0000	0x247c	0xe00	R-- IDATA DISCARDABLE
.idata	0x1b3000	0x1000	0x400	RW- IDATA
.tls	0x1b4000	0x1000	0x200	RW-
.rsrc	0x1b5000	0x19c00	0x19c00	R-- IDATA
.themida	0x1cf000	0xbb8000	0	RWX CODE IDATA
.boot	0xd87000	0x695a00	0x695a00	R-X CODE IDATA
.reloc	0x141d000	0x1000	0x10	R--

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1b3126	0x160
RESOURCE	0x1b5000	0x19ab8
EXCEPTION	0xd5502c	0xc414
SECURITY	0	0
BASERELOC	0x141d000	0x10
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x1b4030	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x1401b4000	0x1401b401c	0x1401b4020	0	0	0

show previews

type	name	size
ICON	#1	4650
ICON	#2	67624
ICON	#3	16936
ICON	#4	9640
ICON	#5	4264
ICON	#6	1128
GROUP_ICON	#101	90
MANIFEST	#1	334

module_name	ord	function_name
kernel32.dll		GetModuleHandleA
USER32.dll		ClientToScreen
IMM32.dll		ImmGetContext
D3DCOMPILER_47.dll		D3DCompile
XINPUT1_4.dll	4
d3d11.dll		D3D11CreateDeviceAndSwapChain
CRYPT32.dll		CertFreeCertificateChain
bcrypt.dll		BCryptCloseAlgorithmProvider
WINHTTP.dll		WinHttpAddRequestHeaders

show previews

offset	size	type	comment
15c1	15	HTM		#
abb68	4650	PNG	(256 x 256)	#
acd92	7004798	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0xd5502c