genesis.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	genesis.exe
size	4194304 (0x400000)
md5	a2a7361390627aff3e221abdff0d416e

type	MS-DOS executable PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	1
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0
ss	0
sp	0x50
checksum	0
ip	0
cs	0
reloc_table_offset	0
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x90

DOS stub

00000000: 0e 1f ba 0f 00 b4 09 cd  21 b0 01 b4 4c cd 21 54  |........!...L.!T|
00000010: 68 69 73 20 70 72 6f 67  72 61 6d 20 63 61 6e 6e  |his program cann|
00000020: 6f 74 20 62 65 20 72 75  6e 20 69 6e 20 4d 53 2d  |ot be run in MS-|
00000030: 44 4f 53 20 6d 6f 64 65  2e 0d 0a 24 00 00 00 00  |DOS mode...$....|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	3
TimeDateStamp	0x602d84c0
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22f
Magic	0x20b
LinkerVersion	0.0
SizeOfCode	0x100000
SizeOfInitializedData	0x100000
SizeOfUninitializedData	0x100000
AddressOfEntryPoint	0x100000
BaseOfCode	0x100000
ImageBase	0x40000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x400000
SizeOfHeaders	0x400
CheckSum	0xffffffff
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x100000	0x100000	0x100000	R-X CODE
.data	0x200000	0x100000	0x100000	RW- IDATA
.idata	0x300000	0x100000	0x100000	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x300000	0x28
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

module_name	hint	ord	function_name
Kernel32.dll			GetStdHandle
Kernel32.dll			WriteConsole

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	4188720	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK