filenameduke3d.exe
size6752400 (0x670890)
md57c029e14225a43bcbd11afdd0ce99868
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x140

DOS stub

00000000: 56 4c 56 00 01 00 00 00  90 08 67 00 d0 bc f6 57  |VLV.......g....W|
00000010: 00 ac be 64 a8 57 34 04  d3 4d 63 a0 5d 51 42 35  |...d.W4..Mc.]QB5|
00000020: 23 2f dc 4d f6 7c 22 fb  e7 2d 5a d3 43 67 05 8c  |#/.M.|"..-Z.Cg..|
00000030: 55 80 8e 5d fc c2 01 3e  5e bd 03 a1 76 a9 89 db  |U..]...>^...v...|
00000040: 3b 52 11 4a 4c e8 4a a1  79 00 48 d4 5f 4c 67 1d  |;R.JL.J.y.H._Lg.|
00000050: f4 4a e7 65 c6 57 ab 31  48 32 f4 53 e1 d7 58 9f  |.J.e.W.1H2.S..X.|
00000060: 92 c9 47 fd b9 16 0c 1a  e9 91 2b 89 69 ab 02 9e  |..G.......+.i...|
00000070: 2c 06 ad 1a d6 0c 30 50  d0 20 eb c5 c0 46 53 0c  |,.....0P. ...FS.|
00000080: d8 7b 89 c6 58 66 fd b4  62 bf df cb 5a 75 25 9e  |.{..Xf..b...Zu%.|
00000090: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000100:

PE Header

SignaturePE
Machine0x14c
NumberOfSections9
TimeDateStamp0x57e51126
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion14.0
SizeOfCode0x247600
SizeOfInitializedData0x18a3000
SizeOfUninitializedData0
AddressOfEntryPoint0x1af0310
BaseOfCode0x1000
BaseOfData0x249000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x1b10000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x2475c10x247600R-X CODE
.rdata0x2490000x87c380x87e00R-- IDATA
.data0x2d10000x17a06a80x307000RW- IDATA
.gfids0x1a720000x126c0x1400R-- IDATA
.tls0x1a7400090x200RW- IDATA
_RDATA0x1a750000x5e00x600R-- IDATA
.rsrc0x1a760000x583080x58400R-- IDATA
.reloc0x1acf0000x208840x20a00R-- IDATA DISCARDABLE
.bind0x1af00000x1f6900x1f690R-X

Data Directory

typevasize
EXPORT00
IMPORT0x2cf91c0xf0
RESOURCE0x1a760000x58308
EXCEPTION00
SECURITY00
BASERELOC0x1acf0000x20884
DEBUG0x2a17800x54
ARCHITECTURE00
GLOBALPTR00
TLS0x2a18340x18
LOAD_CONFIG0x2a17d80x40
Bound_IAT00
IAT0x2490000x344
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x1e740000x1e740080x9d89280x64971400x300000
typenamesizecp
ICON#111280
ICON#242640
ICON#3169360
ICON#4676240
ICON#52703760
GROUP_ICON#101760
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll457GetCommandLineW
KERNEL32.dll824HeapSize
KERNEL32.dll413FreeEnvironmentStringsW
KERNEL32.dll551GetEnvironmentStringsW
KERNEL32.dll456GetCommandLineA
KERNEL32.dll646GetOEMCP
KERNEL32.dll882IsValidCodePage
KERNEL32.dll365FindFirstFileExA
KERNEL32.dll761GetTimeZoneInformation
KERNEL32.dll674GetProcessHeap
KERNEL32.dll402FlushFileBuffers
KERNEL32.dll1504WriteConsoleW
KERNEL32.dll266DeleteFileW
KERNEL32.dll1258SetEndOfFile
KERNEL32.dll1314SetStdHandle
KERNEL32.dll327EnumSystemLocalesW
KERNEL32.dll764GetUserDefaultLCID
KERNEL32.dll884IsValidLocale
KERNEL32.dll759GetTimeFormatW
KERNEL32.dll531GetDateFormatW
KERNEL32.dll420GetACP
KERNEL32.dll704GetStdHandle
KERNEL32.dll610GetModuleFileNameA
KERNEL32.dll819HeapFree
KERNEL32.dll822HeapReAlloc
KERNEL32.dll338ExitThread
KERNEL32.dll815HeapAlloc
KERNEL32.dll476GetConsoleCP
KERNEL32.dll1070QueryPerformanceFrequency
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll514GetCurrentDirectoryA
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll409FormatMessageA
KERNEL32.dll592GetLastError
KERNEL32.dll946LocalFree
KERNEL32.dll791GlobalAlloc
KERNEL32.dll802GlobalLock
KERNEL32.dll809GlobalUnlock
KERNEL32.dll1088RaiseException
KERNEL32.dll560GetFileAttributesA
KERNEL32.dll525GetCurrentThread
KERNEL32.dll1006OpenProcess
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll127CloseHandle
KERNEL32.dll1193RtlCaptureContext
KERNEL32.dll740GetThreadContext
KERNEL32.dll594GetLocaleInfoA
KERNEL32.dll364FindFirstFileA
KERNEL32.dll381FindNextFileA
KERNEL32.dll360FindClose
KERNEL32.dll186CreateFileA
KERNEL32.dll263DeleteFileA
KERNEL32.dll173CreateDirectoryA
KERNEL32.dll593GetLocalTime
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll936LoadLibraryW
KERNEL32.dll414FreeLibrary
KERNEL32.dll669GetProcAddress
KERNEL32.dll1485WideCharToMultiByte
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll709GetStringTypeW
KERNEL32.dll287DuplicateHandle
KERNEL32.dll1452WaitForSingleObjectEx
KERNEL32.dll1362Sleep
KERNEL32.dll557GetExitCodeThread
KERNEL32.dll293EnterCriticalSection
KERNEL32.dll930LeaveCriticalSection
KERNEL32.dll1404TryEnterCriticalSection
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll289EncodePointer
KERNEL32.dll254DecodePointer
KERNEL32.dll1291SetLastError
KERNEL32.dll840InitializeCriticalSectionAndSpinCount
KERNEL32.dll182CreateEventW
KERNEL32.dll1395TlsAlloc
KERNEL32.dll1397TlsGetValue
KERNEL32.dll1398TlsSetValue
KERNEL32.dll1396TlsFree
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll754GetTickCount
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll147CompareStringW
KERNEL32.dll918LCMapStringW
KERNEL32.dll596GetLocaleInfoW
KERNEL32.dll435GetCPInfo
KERNEL32.dll1264SetEvent
KERNEL32.dll1186ResetEvent
KERNEL32.dll1410UnhandledExceptionFilter
KERNEL32.dll1347SetUnhandledExceptionFilter
KERNEL32.dll1377TerminateProcess
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll843InitializeSListHead
KERNEL32.dll239CreateTimerQueue
KERNEL32.dll1360SignalObjectAndWait
KERNEL32.dll1372SwitchToThread
KERNEL32.dll232CreateThread
KERNEL32.dll1333SetThreadPriority
KERNEL32.dll749GetThreadPriority
KERNEL32.dll600GetLogicalProcessorInformation
KERNEL32.dll240CreateTimerQueueTimer
KERNEL32.dll113ChangeTimerQueueTimer
KERNEL32.dll271DeleteTimerQueueTimer
KERNEL32.dll632GetNumaHighestNodeNumber
KERNEL32.dll670GetProcessAffinityMask
KERNEL32.dll1323SetThreadAffinityMask
KERNEL32.dll1157RegisterWaitForSingleObject
KERNEL32.dll1419UnregisterWait
KERNEL32.dll752GetThreadTimes
KERNEL32.dll415FreeLibraryAndExitThread
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll935LoadLibraryExW
KERNEL32.dll773GetVersionExW
KERNEL32.dll1435VirtualAlloc
KERNEL32.dll1438VirtualFree
KERNEL32.dll1441VirtualProtect
KERNEL32.dll1168ReleaseSemaphore
KERNEL32.dll854InterlockedPopEntrySList
KERNEL32.dll855InterlockedPushEntrySList
KERNEL32.dll852InterlockedFlushSList
KERNEL32.dll1060QueryDepthSList
KERNEL32.dll1420UnregisterWaitEx
KERNEL32.dll1197RtlUnwind
KERNEL32.dll337ExitProcess
KERNEL32.dll614GetModuleHandleExW
KERNEL32.dll1261SetEnvironmentVariableA
KERNEL32.dll1104ReadFile
KERNEL32.dll194CreateFileW
KERNEL32.dll574GetFileType
KERNEL32.dll1277SetFilePointerEx
KERNEL32.dll494GetConsoleMode
KERNEL32.dll1102ReadConsoleW
KERNEL32.dll1505WriteFile
WINMM.dll148timeGetTime
XINPUT1_3.dll3
XINPUT1_3.dll2
bink2w32.dll69_BinkWait@4
bink2w32.dll6_BinkDoFrame@4
bink2w32.dll26_BinkNextFrame@4
bink2w32.dll59_BinkShouldSkip@4
bink2w32.dll35_BinkOpenXAudio2@4
bink2w32.dll27_BinkOpen@8
bink2w32.dll1_BinkClose@4
bink2w32.dll53_BinkSetSoundSystem@8
bink2w32.dll4_BinkCopyToBuffer@28
steam_api.dll649SteamAPI_RunCallbacks
steam_api.dll683SteamMatchmaking
steam_api.dll662SteamFriends
steam_api.dll687SteamNetworking
steam_api.dll643SteamAPI_Init
steam_api.dll693SteamUserStats
steam_api.dll694SteamUtils
steam_api.dll647SteamAPI_RegisterCallback
steam_api.dll692SteamUser
steam_api.dll655SteamAPI_UnregisterCallback
steam_api.dll659SteamApps
steam_api.dll646SteamAPI_RegisterCallResult
steam_api.dll690SteamUGC
steam_api.dll654SteamAPI_UnregisterCallResult
d3d11.dll4D3D11CreateDevice
dxgi.dll1CreateDXGIFactory1
USER32.dll247EnumDisplaySettingsW
USER32.dll293GetClientRect
USER32.dll458GetWindowPlacement
USER32.dll161DefWindowProcW
USER32.dll181DispatchMessageW
USER32.dll831TranslateMessage
USER32.dll620PeekMessageW
USER32.dll800ShowWindow
USER32.dll595MoveWindow
USER32.dll3AdjustWindowRectEx
USER32.dll113CreateWindowExW
USER32.dll649RegisterClassExW
USER32.dll545LoadCursorW
USER32.dll426GetSystemMetrics
USER32.dll549LoadImageW
USER32.dll278GetAsyncKeyState
USER32.dll715SetCursorPos
USER32.dll73ClientToScreen
USER32.dll74ClipCursor
USER32.dll459GetWindowRect
USER32.dll795ShowCursor
USER32.dll271GetActiveWindow
USER32.dll676ReleaseCapture
USER32.dll704SetCapture
USER32.dll710SetClipboardData
USER32.dll223EmptyClipboard
USER32.dll606OpenClipboard
USER32.dll582MessageBoxA
USER32.dll75CloseClipboard
GDI32.dll569GetStockObject
SHELL32.dll204SHGetFolderPathA
SHELL32.dll311ShellExecuteW
ole32.dll79CoInitialize
ole32.dll26CoCreateInstance
ole32.dll127CoUninitialize
offsetsizetypecomment
15c115HTM#
15d06746816BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x5d8928