conhost.exe

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	conhost.exe
size	4802048 (0x494600)
md5	701307eff331b8790cb8739de3269d22

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x140

Rich Header

lib id	version	times used
110	50727	1
96	3077	1
171	40219	38
156	40219	12
150	20413	12
149	30729	69
109	50727	1
132	30729	596
156	30319	2
171	30319	1
131	30729	267
156	21202	2
123	50727	29
147	30729	8
1	0	624
138	30729	354
146	30729	1
148	21022	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x570f4db8
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x122
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0x719400
SizeOfInitializedData	0x214200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x14d7498
BaseOfCode	0x1000
BaseOfData	0x71b000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x14da000
SizeOfHeaders	0x400
CheckSum	0x93873c
Subsystem	2
DllCharacteristics	0x8040
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
	0x1000	0x71a000	0x2b5200	RWX IDATA
	0x71b000	0x16e000	0x90a00	RWX IDATA
	0x889000	0x852000	0xda00	RWX IDATA
	0x10db000	0x1000	0	RWX IDATA
	0x10dc000	0x1000	0x200	RWX IDATA
	0x10dd000	0x70000	0x32400	RWX IDATA
.rsrc	0x114d000	0x1000	0x800	RWX IDATA
	0x114e000	0x27e000	0	RWX IDATA
.datari	0x13cc000	0x10e000	0x10de00	RWX IDATA

Data Directory

type	va	size
EXPORT	0x13cc048	0x493
IMPORT	0x13cc4dc	0x670
RESOURCE	0x114d000	0x7c8
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x13cc028	0x10
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x13cc000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x14db000	0x14db008	0x17cc018	0x17cc020	0	0

show previews

type	name	size	cp
ICON	#1	1128	1252
GROUP_ICON	#1005	20	1252
MANIFEST	#1	609	1252

module_name	ord	function_name
kernel32.dll		GetModuleHandleA
kernel32.dll		GetProcAddress
kernel32.dll		ExitProcess
kernel32.dll		LoadLibraryA
user32.dll		MessageBoxA
advapi32.dll		RegCloseKey
oleaut32.dll		SysFreeString
gdi32.dll		CreateFontA
shell32.dll		ShellExecuteA
version.dll		GetFileVersionInfoA
WINMM.dll		timeEndPeriod
WS2_32.dll	52
d3dx9_43.dll		D3DXMatrixMultiply
d3d9.dll		Direct3DCreate9
IPHLPAPI.DLL		IcmpCreateFile
CRYPT32.dll		CertOpenStore
fmodex.dll		public: enum FMOD_RESULT __stdcall FMOD::System::setSoftwareFormat(int, enum FMOD_SOUND_FORMAT, int, int, enum FMOD_DSP_RESAMPLER) ?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SOUND_FORMAT@@HHW4FMOD_DSP_RESAMPLER@@@Z
fmod_event.dll		public: enum FMOD_RESULT __stdcall FMOD::Event::getInfo(int , char , struct FMOD_EVENT_INFO ) ?getInfo@Event@FMOD@@QAG?AW4FMOD_RESULT@@PAHPAPADPAUFMOD_EVENT_INFO@@@Z
fmod_event_net.dll		enum FMOD_RESULT __stdcall FMOD::NetEventSystem_Shutdown(void) ?NetEventSystem_Shutdown@FMOD@@YG?AW4FMOD_RESULT@@XZ
PhysX3_x86.dll		PxCreateBasePhysics
PhysX3Cooking_x86.dll		PxCreateCooking
PhysX3Common_x86.dll		public: __thiscall physx::Gu::Box::Box(void) ??0Box@Gu@physx@@QAE@XZ
ts3client_win32.dll		ts3client_createIdentity
PSAPI.DLL		GetModuleBaseNameA
CrashRpt1301.dll	9
DINPUT8.dll		DirectInput8Create
XINPUT1_3.dll	2

ord	entry_va	function_name
1	0x15480	??0System@Scaleform@@QAE@ABUHeapDesc@MemoryHeap@1@PAVSysAllocBase@1@@Z
2	0x15460	??0System@Scaleform@@QAE@PAVSysAllocBase@1@@Z
3	0x153b0	??1AcquireInterface@Scaleform@@UAE@XZ
4	0x153b0	??1DefaultAcquireInterface@Scaleform@@UAE@XZ
5	0x154a0	??1System@Scaleform@@QAE@XZ
6	0x15430	??_FEvent@Scaleform@@QAEXXZ
7	0x15420	??_FMutex@Scaleform@@QAEXXZ
8	0x15440	??_FSemaphore@Scaleform@@QAEXXZ
9	0x164390	??_FSysAllocPagedMalloc@Scaleform@@QAEXXZ
10	0x152c0	??_FSysAllocStatic@Scaleform@@QAEXXZ
11	0x1643a0	??_FSysAllocWinAPI@Scaleform@@QAEXXZ
12	0x15500	??_FSystem@Scaleform@@QAEXXZ
13	0x15450	??_FThread@Scaleform@@QAEXXZ
14	0x15cd0	?GetXScale@?$Matrix2x4@M@Render@Scaleform@@QBEMXZ
15	0x15cf0	?GetYScale@?$Matrix2x4@M@Render@Scaleform@@QBEMXZ
16	0x15540	?Init@System@GFx@Scaleform@@SAXPAVSysAllocBase@3@@Z
17	0x154b0	?Init@System@Scaleform@@SAXPAVSysAllocBase@2@@Z
18	0x167810	?Prepend@?$Matrix2x4@M@Render@Scaleform@@QAEAAV123@ABV123@@Z
19	0x15c90	?SetIdentity@?$Matrix2x4@M@Render@Scaleform@@QAEXXZ
20	0x15d10	?SetIdentity@?$Matrix3x4@M@Render@Scaleform@@QAEXXZ
21	0x15d40	?SetIdentity@?$Matrix4x4@M@Render@Scaleform@@QAEXXZ

module_name	conhost.exe
flags	0
timestamp	2016-04-14 07:58:00
version	0.0
ordinal_base	1
nFunctions	21
nNames	21
Names(21)	0x13cc0fc
Functions(21)	0x13cc0a8
NameOrdinals(21)	0x13cc07c

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	4796464	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK