filenamepokemid.exe
size4312064 (0x41cc00)
md573dde1562b2a971767b31eb8622b1a00
typePE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0xa
TimeDateStamp0
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22f
Magic0x20b
LinkerVersion2.29
SizeOfCode0x34b200
SizeOfInitializedData0x41c800
SizeOfUninitializedData0x1400
AddressOfEntryPoint0x1500
BaseOfCode0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x426000
SizeOfHeaders0x400
CheckSum0x41f899
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x200000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x34b0280x34b200R-X CODE IDATA
.data0x34d0000x749e00x74a00RW- IDATA
.rdata0x3c20000x521b00x52200R-- IDATA
.pdata0x4150000x40200x4200R-- IDATA
.xdata0x41a0000x37a40x3800R-- IDATA
.bss0x41e0000x13980RW- UDATA
.idata0x4200000x278c0x2800RW- IDATA
.CRT0x4230000x680x200RW- IDATA
.tls0x4240000x680x200RW- IDATA
.rsrc0x4250000x2780x400RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x4200000x278c
RESOURCE0x4250000x278
EXCEPTION0x4150000x4020
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x4240200x28
LOAD_CONFIG00
Bound_IAT00
IAT0x4209b80x8f0
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x8240000x8240600x81e61c0x82304000
typenamesizecp
MANIFEST#15440
module_namehintordfunction_name
dbghelp.dll28MiniDumpWriteDump
dbghelp.dll32StackWalk64
dbghelp.dll71SymFromAddr
dbghelp.dll80SymFunctionTableAccess64
dbghelp.dll85SymGetLineFromAddr64
dbghelp.dll97SymGetModuleBase64
dbghelp.dll132SymInitialize
GDI32.dll143DeleteObject
KERNEL32.dll13AddVectoredContinueHandler
KERNEL32.dll85CloseHandle
KERNEL32.dll134CreateEventA
KERNEL32.dll149CreateFileW
KERNEL32.dll178CreateSemaphoreA
KERNEL32.dll194CreateTimerQueue
KERNEL32.dll195CreateTimerQueueTimer
KERNEL32.dll217DeleteCriticalSection
KERNEL32.dll225DeleteTimerQueueEx
KERNEL32.dll226DeleteTimerQueueTimer
KERNEL32.dll250EnterCriticalSection
KERNEL32.dll306FileTimeToLocalFileTime
KERNEL32.dll307FileTimeToSystemTime
KERNEL32.dll333FindFirstVolumeW
KERNEL32.dll344FindNextVolumeW
KERNEL32.dll350FindVolumeClose
KERNEL32.dll356FlushConsoleInputBuffer
KERNEL32.dll363FormatMessageA
KERNEL32.dll364FormatMessageW
KERNEL32.dll366FreeEnvironmentStringsA
KERNEL32.dll367FreeEnvironmentStringsW
KERNEL32.dll368FreeLibrary
KERNEL32.dll374GetACP
KERNEL32.dll385GetCPInfo
KERNEL32.dll406GetCommandLineW
KERNEL32.dll425GetConsoleCP
KERNEL32.dll443GetConsoleMode
KERNEL32.dll463GetCurrentProcess
KERNEL32.dll464GetCurrentProcessId
KERNEL32.dll467GetCurrentThread
KERNEL32.dll468GetCurrentThreadId
KERNEL32.dll479GetDiskFreeSpaceExW
KERNEL32.dll489GetEnvironmentStrings
KERNEL32.dll491GetEnvironmentStringsW
KERNEL32.dll493GetEnvironmentVariableW
KERNEL32.dll502GetFileAttributesA
KERNEL32.dll509GetFileInformationByHandle
KERNEL32.dll514GetFileSizeEx
KERNEL32.dll515GetFileTime
KERNEL32.dll516GetFileType
KERNEL32.dll524GetFullPathNameW
KERNEL32.dll530GetLastError
KERNEL32.dll532GetLocalTime
KERNEL32.dll549GetModuleFileNameW
KERNEL32.dll550GetModuleHandleA
KERNEL32.dll553GetModuleHandleW
KERNEL32.dll572GetNumaHighestNodeNumber
KERNEL32.dll600GetProcAddress
KERNEL32.dll613GetProcessTimes
KERNEL32.dll629GetStartupInfoA
KERNEL32.dll631GetStdHandle
KERNEL32.dll646GetSystemInfo
KERNEL32.dll650GetSystemTime
KERNEL32.dll651GetSystemTimeAdjustment
KERNEL32.dll652GetSystemTimeAsFileTime
KERNEL32.dll663GetTempFileNameW
KERNEL32.dll665GetTempPathW
KERNEL32.dll679GetTickCount
KERNEL32.dll683GetTimeFormatW
KERNEL32.dll684GetTimeZoneInformation
KERNEL32.dll700GetVolumeInformationW
KERNEL32.dll725GlobalMemoryStatusEx
KERNEL32.dll736HeapAlloc
KERNEL32.dll738HeapCreate
KERNEL32.dll740HeapDestroy
KERNEL32.dll742HeapFree
KERNEL32.dll747HeapSetInformation
KERNEL32.dll763InitializeCriticalSection
KERNEL32.dll786IsDBCSLeadByteEx
KERNEL32.dll845LeaveCriticalSection
KERNEL32.dll850LoadLibraryExW
KERNEL32.dll851LoadLibraryW
KERNEL32.dll859LocalFileTimeToFileTime
KERNEL32.dll861LocalFree
KERNEL32.dll889MoveFileW
KERNEL32.dll893MultiByteToWideChar
KERNEL32.dll929OutputDebugStringA
KERNEL32.dll931PeekConsoleInputA
KERNEL32.dll933PeekNamedPipe
KERNEL32.dll960QueryPerformanceCounter
KERNEL32.dll961QueryPerformanceFrequency
KERNEL32.dll975ReadConsoleInputA
KERNEL32.dll1009ReleaseSemaphore
KERNEL32.dll1018RemoveVectoredContinueHandler
KERNEL32.dll1026ResetEvent
KERNEL32.dll1031RtlAddFunctionTable
KERNEL32.dll1032RtlCaptureContext
KERNEL32.dll1039RtlLookupFunctionEntry
KERNEL32.dll1046RtlVirtualUnwind
KERNEL32.dll1051SearchPathW
KERNEL32.dll1069SetConsoleCtrlHandler
KERNEL32.dll1085SetConsoleMode
KERNEL32.dll1107SetEndOfFile
KERNEL32.dll1111SetEnvironmentVariableW
KERNEL32.dll1113SetEvent
KERNEL32.dll1126SetFilePointer
KERNEL32.dll1130SetFileTime
KERNEL32.dll1138SetLastError
KERNEL32.dll1141SetLocalTime
KERNEL32.dll1162SetSystemTime
KERNEL32.dll1163SetSystemTimeAdjustment
KERNEL32.dll1189SetUnhandledExceptionFilter
KERNEL32.dll1202Sleep
KERNEL32.dll1213SystemTimeToFileTime
KERNEL32.dll1216TerminateProcess
KERNEL32.dll1223TlsGetValue
KERNEL32.dll1236UnhandledExceptionFilter
KERNEL32.dll1239UnmapViewOfFile
KERNEL32.dll1260VirtualAlloc
KERNEL32.dll1264VirtualFree
KERNEL32.dll1267VirtualProtect
KERNEL32.dll1269VirtualQuery
KERNEL32.dll1275WaitForMultipleObjects
KERNEL32.dll1277WaitForSingleObject
KERNEL32.dll1301WideCharToMultiByte
msvcrt.dll55__C_specific_handler
msvcrt.dll63___lc_codepage_func
msvcrt.dll78__dllonexit
msvcrt.dll81__getmainargs
msvcrt.dll82__initenv
msvcrt.dll83__iob_func
msvcrt.dll90__lconv_init
msvcrt.dll91__mb_cur_max
msvcrt.dll96__set_app_type
msvcrt.dll98__setusermatherr
msvcrt.dll115_access
msvcrt.dll116_acmdln
msvcrt.dll123_amsg_exit
msvcrt.dll124_assert
msvcrt.dll137_beginthreadex
msvcrt.dll141_cexit
msvcrt.dll153_close
msvcrt.dll158_chmod
msvcrt.dll176_creat
msvcrt.dll177_ctime64
msvcrt.dll193_dup
msvcrt.dll194_dup2
msvcrt.dll201_environ
msvcrt.dll203_errno
msvcrt.dll220_exit
msvcrt.dll237_fileno
msvcrt.dll253_fmode
msvcrt.dll257_fpreset
msvcrt.dll272_fstat64
msvcrt.dll292_get_osfhandle
msvcrt.dll308_getpid
msvcrt.dll332_initterm
msvcrt.dll336_isatty
msvcrt.dll337_isatty
msvcrt.dll440_lock
msvcrt.dll452_lseeki64
msvcrt.dll602_mkdir
msvcrt.dll613_onexit
msvcrt.dll616_open_osfhandle
msvcrt.dll623_pipe
msvcrt.dll640_read
msvcrt.dll645_read
msvcrt.dll673_setmode
msvcrt.dll688_snwprintf
msvcrt.dll731_strdup
msvcrt.dll789_telli64
msvcrt.dll791_time64
msvcrt.dll811_umask
msvcrt.dll817_unlink
msvcrt.dll821_unlock
msvcrt.dll823_utime64
msvcrt.dll858_vsnwprintf
msvcrt.dll884_wcsdup
msvcrt.dll890_wcsdup
msvcrt.dll944_wfdopen
msvcrt.dll986_write
msvcrt.dll987_write
msvcrt.dll1005_wsplitpath_s
msvcrt.dll1007_wstat64
msvcrt.dll1009_wstat
msvcrt.dll1033abort
msvcrt.dll1035acos
msvcrt.dll1036acosf
msvcrt.dll1038asin
msvcrt.dll1039asinf
msvcrt.dll1040atan
msvcrt.dll1043atanf
msvcrt.dll1044atexit
msvcrt.dll1045atof
msvcrt.dll1046atoi
msvcrt.dll1048bsearch
msvcrt.dll1050calloc
msvcrt.dll1056cos
msvcrt.dll1057cosf
msvcrt.dll1058cosh
msvcrt.dll1059coshf
msvcrt.dll1063exit
msvcrt.dll1064exp
msvcrt.dll1065expf
msvcrt.dll1067fclose
msvcrt.dll1068feof
msvcrt.dll1070fflush
msvcrt.dll1082fprintf
msvcrt.dll1084fputc
msvcrt.dll1086fputwc
msvcrt.dll1088fread
msvcrt.dll1089free
msvcrt.dll1095fseek
msvcrt.dll1097ftell
msvcrt.dll1098fwprintf
msvcrt.dll1099fwprintf
msvcrt.dll1101fwrite
msvcrt.dll1104getc
msvcrt.dll1106getenv
msvcrt.dll1119islower
msvcrt.dll1122isspace
msvcrt.dll1123isupper
msvcrt.dll1139ldexp
msvcrt.dll1141localeconv
msvcrt.dll1143log
msvcrt.dll1146logf
msvcrt.dll1148malloc
msvcrt.dll1151mbstowcs
msvcrt.dll1154memchr
msvcrt.dll1155memcmp
msvcrt.dll1156memcpy
msvcrt.dll1157memmove
msvcrt.dll1158memset
msvcrt.dll1163pow
msvcrt.dll1164powf
msvcrt.dll1172qsort
msvcrt.dll1174raise
msvcrt.dll1176realloc
msvcrt.dll1184setlocale
msvcrt.dll1186signal
msvcrt.dll1187sin
msvcrt.dll1188sinf
msvcrt.dll1189sinh
msvcrt.dll1190sinhf
msvcrt.dll1200strcmp
msvcrt.dll1202strcpy
msvcrt.dll1205strerror
msvcrt.dll1207strlen
msvcrt.dll1210strncmp
msvcrt.dll1211strncpy
msvcrt.dll1214strrchr
msvcrt.dll1216strstr
msvcrt.dll1218strtok
msvcrt.dll1220strtol
msvcrt.dll1225swprintf_s
msvcrt.dll1229tan
msvcrt.dll1230tanf
msvcrt.dll1231tanh
msvcrt.dll1242vfprintf
msvcrt.dll1254wcscat
msvcrt.dll1257wcscmp
msvcrt.dll1259wcscpy
msvcrt.dll1263wcslen
msvcrt.dll1266wcsncmp
msvcrt.dll1269wcsnlen
PSAPI.DLL4EnumProcessModules
PSAPI.DLL16GetModuleFileNameExW
PSAPI.DLL17GetModuleInformation
SHELL32.dll10CommandLineToArgvW
USER32.dll491MessageBoxA
USER32.dll498MessageBoxW
WINMM.dll149timeBeginPeriod
WINMM.dll150timeEndPeriod
WINMM.dll151timeGetDevCaps
WSOCK32.dll26WSAGetLastError
WSOCK32.dll37closesocket
WSOCK32.dll61recv
WSOCK32.dll66select
WSOCK32.dll67send
offsetsizetypecomment
15c115HTM#
15d04306480BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x41e61c