filenameskadro-official (Fork)-z175-gamehack-kdmapper.exe
size102912 (0x19200)
md5712b0e9e9bfb5515a18c0da140df14ce
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf0

Rich Header

lib idversiontimes used
1473072914
2602892010
259289203
2612892031
257289206
257274129
10227
265290096
255290091
258290091

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x5ef9cc8a
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.27
SizeOfCode0xa200
SizeOfInitializedData0xf400
SizeOfUninitializedData0
AddressOfEntryPoint0xa16c
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x1e000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000xa0680xa200R-X CODE
.rdata0xc0000xd5380xd600R-- IDATA
.data0x1a0000xc200x600RW- IDATA
.pdata0x1b0000xa980xc00R-- IDATA
.rsrc0x1c0000x1e00x200R-- IDATA
.reloc0x1d0000xec0x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x17b400x118
RESOURCE0x1c0000x1e0
EXCEPTION0x1b0000xa98
SECURITY00
BASERELOC0x1d0000xec
DEBUG0x158000x70
ARCHITECTURE00
GLOBALPTR00
TLS0x159a00x28
LOAD_CONFIG0x158700x130
Bound_IAT00
IAT0xc0000x518
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x1400168180x1400168200x14001ab740x14000c59800x300000
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
ntdll.dll1256RtlLookupFunctionEntry
ntdll.dll1575RtlVirtualUnwind
ntdll.dll504NtQuerySystemInformation
ntdll.dll1114RtlImageNtHeader
ntdll.dll1113RtlImageDirectoryEntryToData
ntdll.dll754RtlCaptureContext
KERNEL32.dll875InitializeCriticalSectionEx
KERNEL32.dll205CreateFileW
KERNEL32.dll766GetTempPathA
KERNEL32.dll617GetLastError
KERNEL32.dll967LoadLibraryA
KERNEL32.dll136CloseHandle
KERNEL32.dll1495VirtualAlloc
KERNEL32.dll695GetProcAddress
KERNEL32.dll275DeleteCriticalSection
KERNEL32.dll544GetCurrentProcessId
KERNEL32.dll291DeviceIoControl
KERNEL32.dll1498VirtualFree
KERNEL32.dll754GetSystemTimeAsFileTime
KERNEL32.dll878InitializeSListHead
KERNEL32.dll430FormatMessageA
KERNEL32.dll981LocalFree
KERNEL32.dll35AreFileApisANSI
KERNEL32.dll1344SetLastError
KERNEL32.dll640GetModuleHandleW
KERNEL32.dll1013MultiByteToWideChar
KERNEL32.dll1551WideCharToMultiByte
KERNEL32.dll900IsDebuggerPresent
KERNEL32.dll1053OutputDebugStringW
KERNEL32.dll874InitializeCriticalSectionAndSpinCount
KERNEL32.dll193CreateEventW
KERNEL32.dll1470UnhandledExceptionFilter
KERNEL32.dll1405SetUnhandledExceptionFilter
KERNEL32.dll543GetCurrentProcess
KERNEL32.dll1436TerminateProcess
KERNEL32.dll907IsProcessorFeaturePresent
KERNEL32.dll1105QueryPerformanceCounter
KERNEL32.dll592GetFileInformationByHandle
KERNEL32.dll587GetFileAttributesExW
KERNEL32.dll387FindFirstFileExW
KERNEL32.dll381FindClose
KERNEL32.dll548GetCurrentThreadId
ADVAPI32.dll101CloseServiceHandle
ADVAPI32.dll534OpenSCManagerA
ADVAPI32.dll236DeleteService
ADVAPI32.dll106ControlService
ADVAPI32.dll760StartServiceA
ADVAPI32.dll536OpenServiceA
ADVAPI32.dll143CreateServiceA
MSVCP140.dll433public: static unsigned __int64 __cdecl std::codecvt<char, char, struct _Mbstatet>::_Getcat(class std::locale::facet const * __ptr64 * __ptr64, class std::locale const * __ptr64)

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

MSVCP140.dll1173public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sbumpc(void) __ptr64

?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

MSVCP140.dll969public: static class std::locale::id std::codecvt<char, char, struct _Mbstatet>::id

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

MSVCP140.dll1319public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::unshift(struct _Mbstatet & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64

?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

MSVCP140.dll47protected: __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

MSVCP140.dll960public: class std::locale __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::getloc(void)const __ptr64

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

MSVCP140.dll501protected: void __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Init(void) __ptr64

?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

MSVCP140.dll26public: __cdecl std::basic_istream<char, struct std::char_traits<char> >::basic_istream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64, bool) __ptr64

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

MSVCP140.dll1018public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::in(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

MSVCP140.dll1075public: int __cdecl std::codecvt<char, char, struct _Mbstatet>::out(struct _Mbstatet & __ptr64, char const * __ptr64, char const * __ptr64, char const * __ptr64 & __ptr64, char * __ptr64, char * __ptr64, char * __ptr64 & __ptr64)const __ptr64

?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

MSVCP140.dll586protected: char * __ptr64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::_Pninc(void) __ptr64

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

MSVCP140.dll12protected: __cdecl std::basic_ios<char, struct std::char_traits<char> >::basic_ios<char, struct std::char_traits<char> >(void) __ptr64

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

MSVCP140.dll37public: __cdecl std::basic_ostream<char, struct std::char_traits<char> >::basic_ostream<char, struct std::char_traits<char> >(class std::basic_streambuf<char, struct std::char_traits<char> > * __ptr64, bool) __ptr64

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

MSVCP140.dll137public: virtual __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::~basic_streambuf<char, struct std::char_traits<char> >(void) __ptr64

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

MSVCP140.dll1237protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::showmanyc(void) __ptr64

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

MSVCP140.dll1347protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsgetn(char * __ptr64, __int64) __ptr64

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

MSVCP140.dll1350protected: virtual __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::xsputn(char const * __ptr64, __int64) __ptr64

?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

MSVCP140.dll125public: virtual __cdecl std::basic_ios<char, struct std::char_traits<char> >::~basic_ios<char, struct std::char_traits<char> >(void) __ptr64

??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

MSVCP140.dll134public: virtual __cdecl std::basic_ostream<char, struct std::char_traits<char> >::~basic_ostream<char, struct std::char_traits<char> >(void) __ptr64

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

MSVCP140.dll1343public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::write(char const * __ptr64, __int64) __ptr64

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

MSVCP140.dll131public: virtual __cdecl std::basic_istream<char, struct std::char_traits<char> >::~basic_istream<char, struct std::char_traits<char> >(void) __ptr64

??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

MSVCP140.dll669public: bool __cdecl std::codecvt_base::always_noconv(void)const __ptr64

?always_noconv@codecvt_base@std@@QEBA_NXZ

MSVCP140.dll305public: __cdecl std::locale::id::operator unsigned __int64(void) __ptr64

??Bid@locale@std@@QEAA_KXZ

MSVCP140.dll469private: static class std::locale::_Locimp * __ptr64 __cdecl std::locale::_Getgloballocale(void)

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

MSVCP140.dll109public: __cdecl std::_Lockit::_Lockit(int) __ptr64

??0_Lockit@std@@QEAA@H@Z

MSVCP140.dll165public: __cdecl std::_Lockit::~_Lockit(void) __ptr64

??1_Lockit@std@@QEAA@XZ

MSVCP140.dll257public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(long) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z

MSVCP140.dll264public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::ios_base & __ptr64 (__cdecl*)(class std::ios_base & __ptr64)) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

MSVCP140.dll1230struct std::_Smanip<__int64> __cdecl std::setw(__int64)

?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

MSVCP140.dll627char const * __ptr64 __cdecl std::_Syserror_map(int)

?_Syserror_map@std@@YAPEBDH@Z

MSVCP140.dll645int __cdecl std::_Winerror_map(int)

?_Winerror_map@std@@YAHH@Z

MSVCP140.dll266public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(void const * __ptr64) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z

MSVCP140.dll262public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 (__cdecl*)(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64)) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

MSVCP140.dll1221public: void __cdecl std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) __ptr64

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

MSVCP140.dll872public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::flush(void) __ptr64

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

MSVCP140.dll580public: void __cdecl std::basic_ostream<char, struct std::char_traits<char> >::_Osfx(void) __ptr64

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

MSVCP140.dll1246public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputc(char) __ptr64

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

MSVCP140.dll1121public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::put(char) __ptr64

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

MSVCP140.dll1332public: char __cdecl std::basic_ios<char, struct std::char_traits<char> >::widen(char)const __ptr64

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

MSVCP140.dll1249public: __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputn(char const * __ptr64, __int64) __ptr64

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

MSVCP140.dll654void __cdecl std::_Xlength_error(char const * __ptr64)

?_Xlength_error@std@@YAXPEBD@Z

MSVCP140.dll1310bool __cdecl std::uncaught_exception(void)

?uncaught_exception@std@@YA_NXZ

MSVCP140.dll692class std::basic_ostream<char, struct std::char_traits<char> > std::cout

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

MSVCP140.dll427struct _iobuf * __ptr64 __cdecl std::_Fiopen(char const * __ptr64, int, int)

?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

MSVCP140.dll1231public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sgetc(void) __ptr64

?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

VCRUNTIME140_1.dll__CxxFrameHandler4
VCRUNTIME140.dll27__current_exception
VCRUNTIME140.dll8__C_specific_handler
VCRUNTIME140.dll62memset
VCRUNTIME140.dll28__current_exception_context
VCRUNTIME140.dll60memcpy
VCRUNTIME140.dll33__std_exception_copy
VCRUNTIME140.dll34__std_exception_destroy
VCRUNTIME140.dll1_CxxThrowException
VCRUNTIME140.dll61memmove
VCRUNTIME140.dll59memcmp
VCRUNTIME140.dll35__std_terminate
api-ms-win-crt-heap-l1-1-0.dll8_callnewh
api-ms-win-crt-heap-l1-1-0.dll22_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll25malloc
api-ms-win-crt-heap-l1-1-0.dll24free
api-ms-win-crt-filesystem-l1-1-0.dll22_lock_file
api-ms-win-crt-filesystem-l1-1-0.dll36_unlock_file
api-ms-win-crt-filesystem-l1-1-0.dll63remove
api-ms-win-crt-string-l1-1-0.dll42_stricmp
api-ms-win-crt-runtime-l1-1-0.dll61_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-runtime-l1-1-0.dll40_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll85exit
api-ms-win-crt-runtime-l1-1-0.dll35_exit
api-ms-win-crt-runtime-l1-1-0.dll66_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll64_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll57_invalid_parameter_noinfo_noreturn
api-ms-win-crt-runtime-l1-1-0.dll30_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll60_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll52_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll51_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll24_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll21_c_exit
api-ms-win-crt-runtime-l1-1-0.dll5__p___argv
api-ms-win-crt-runtime-l1-1-0.dll4__p___argc
api-ms-win-crt-runtime-l1-1-0.dll22_cexit
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll103terminate
api-ms-win-crt-stdio-l1-1-0.dll136fsetpos
api-ms-win-crt-stdio-l1-1-0.dll157ungetc
api-ms-win-crt-stdio-l1-1-0.dll47_fseeki64
api-ms-win-crt-stdio-l1-1-0.dll121fgetpos
api-ms-win-crt-stdio-l1-1-0.dll138fwrite
api-ms-win-crt-stdio-l1-1-0.dll84_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll152setvbuf
api-ms-win-crt-stdio-l1-1-0.dll131fread
api-ms-win-crt-stdio-l1-1-0.dll120fgetc
api-ms-win-crt-stdio-l1-1-0.dll116fclose
api-ms-win-crt-stdio-l1-1-0.dll119fflush
api-ms-win-crt-stdio-l1-1-0.dll127fputc
api-ms-win-crt-stdio-l1-1-0.dll1__p__commode
api-ms-win-crt-stdio-l1-1-0.dll57_get_stream_buffer_pointers
api-ms-win-crt-locale-l1-1-0.dll8_configthreadlocale
api-ms-win-crt-locale-l1-1-0.dll___lc_codepage_func
api-ms-win-crt-math-l1-1-0.dll9__setusermatherr
offsetsizetypecomment
15c115HTM#
15d097328BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x1ab74