nv2xb.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	nv2xb.exe
size	12800 (0x3200)
md5	752e21395a982ef6ae3bc7c170499af9

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
147	30729	10
257	24123	2
259	24123	2
261	24123	17
260	24123	12
257	24215	2
203	65501	7
1	0	70
265	24215	1
255	24210	1
258	24215	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	7
TimeDateStamp	0x581ba91b
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.0
SizeOfCode	0x1200
SizeOfInitializedData	0x2200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x1698
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0xa000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x11d8	0x1200	R-X CODE
.rdata	0x3000	0x11aa	0x1200	R-- IDATA
.data	0x5000	0x638	0x200	RW- IDATA
.pdata	0x6000	0x1c8	0x200	R-- IDATA
.gfids	0x7000	0x1c	0x200	R-- IDATA
.rsrc	0x8000	0x1e0	0x200	R-- IDATA
.reloc	0x9000	0x1c	0x200	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x38ac	0xdc
RESOURCE	0x8000	0x1e0
EXCEPTION	0x6000	0x1c8
SECURITY	0	0
BASERELOC	0x9000	0x1c
DEBUG	0x3330	0x70
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x33a0	0x94
Bound_IAT	0	0
IAT	0x3000	0x260
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
MANIFEST	#1	381	0

module_name	hint	ord	function_name
KERNEL32.dll	1377		Sleep
KERNEL32.dll	29		AttachConsole
KERNEL32.dll	528		GetCurrentProcessId
KERNEL32.dll	21		AllocConsole
KERNEL32.dll	709		GetStartupInfoW
KERNEL32.dll	874		IsDebuggerPresent
KERNEL32.dll	852		InitializeSListHead
KERNEL32.dll	733		GetSystemTimeAsFileTime
KERNEL32.dll	532		GetCurrentThreadId
KERNEL32.dll	1072		QueryPerformanceCounter
KERNEL32.dll	880		IsProcessorFeaturePresent
KERNEL32.dll	1392		TerminateProcess
KERNEL32.dll	527		GetCurrentProcess
KERNEL32.dll	1362		SetUnhandledExceptionFilter
KERNEL32.dll	1426		UnhandledExceptionFilter
KERNEL32.dll	1212		RtlVirtualUnwind
KERNEL32.dll	1205		RtlLookupFunctionEntry
KERNEL32.dll	1198		RtlCaptureContext
KERNEL32.dll	621		GetModuleHandleW
USER32.dll	623		PeekMessageA
USER32.dll	808		ShowWindow
USER32.dll	651		RegisterClassA
USER32.dll	160		DefWindowProcA
USER32.dll	112		CreateWindowExA
USER32.dll	839		TranslateMessage
USER32.dll	848		UnregisterClassA
USER32.dll	629		PostQuitMessage
USER32.dll	863		UpdateWindow
USER32.dll	180		DispatchMessageA
ViGEmUM.dll	1		vigem_init
ViGEmUM.dll	8		vigem_xusb_submit_report
ViGEmUM.dll	4		vigem_shutdown
ViGEmUM.dll	6		vigem_target_unplug
ViGEmUM.dll	3		vigem_register_xusb_notification
ViGEmUM.dll	5		vigem_target_plugin
XINPUT1_4.dll		5
XINPUT1_4.dll		3
XINPUT1_4.dll		2
VCRUNTIME140.dll	62		memset
VCRUNTIME140.dll	8		__C_specific_handler
api-ms-win-crt-stdio-l1-1-0.dll	1		__p__commode
api-ms-win-crt-stdio-l1-1-0.dll	3		__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll	116		fclose
api-ms-win-crt-stdio-l1-1-0.dll			__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll	125		fopen
api-ms-win-crt-stdio-l1-1-0.dll	133		freopen
api-ms-win-crt-stdio-l1-1-0.dll	84		_set_fmode
api-ms-win-crt-runtime-l1-1-0.dll	64		_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	52		_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	60		_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	21		_c_exit
api-ms-win-crt-runtime-l1-1-0.dll	30		_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	103		terminate
api-ms-win-crt-runtime-l1-1-0.dll	66		_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	22		_cexit
api-ms-win-crt-runtime-l1-1-0.dll	61		_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	35		_exit
api-ms-win-crt-runtime-l1-1-0.dll	85		exit
api-ms-win-crt-runtime-l1-1-0.dll	55		_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	54		_initterm
api-ms-win-crt-runtime-l1-1-0.dll	43		_get_narrow_winmain_command_line
api-ms-win-crt-runtime-l1-1-0.dll	24		_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	51		_initialize_narrow_environment
api-ms-win-crt-math-l1-1-0.dll	9		__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll	8		_configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll	22		_set_new_mode

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	7216	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK