oxipng.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	oxipng.exe
size	1611264 (0x189600)
md5	b4ef6697ed0ab5112804730b7d9f28d9

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
147	30729	10
257	32533	2
261	32533	24
260	32533	10
259	32533	4
257	30148	4
257	30795	5
1	0	117
260	32824	8
0	0	187
258	32824	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	5
TimeDateStamp	0x6524a34f
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.37
SizeOfCode	0x12c400
SizeOfInitializedData	0x5da00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x124fbc
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x18e000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x12c2ff	0x12c400	R-X CODE
.rdata	0x12e000	0x50054	0x50200	R-- IDATA
.data	0x17f000	0xc70	0x200	RW- IDATA
.pdata	0x180000	0xb58c	0xb600	R-- IDATA
.reloc	0x18c000	0x135c	0x1400	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x17d234	0xdc
RESOURCE	0	0
EXCEPTION	0x180000	0xb58c
SECURITY	0	0
BASERELOC	0x18c000	0x135c
DEBUG	0x153b10	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x153b80	0x28
LOAD_CONFIG	0x1539d0	0x140
Bound_IAT	0	0
IAT	0x12e000	0x3d0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x140154018	0x140154128	0x14017f664	0x14012e450	0	0x400000

module_name	hint	function_name
ADVAPI32.dll	793	SystemFunction036
KERNEL32.dll	876	HeapAlloc
KERNEL32.dll	724	GetProcessHeap
KERNEL32.dll	880	HeapFree
KERNEL32.dll	883	HeapReAlloc
KERNEL32.dll	755	GetStdHandle
KERNEL32.dll	534	GetConsoleMode
KERNEL32.dll	1323	SetConsoleMode
KERNEL32.dll	637	GetLastError
KERNEL32.dll	1332	SetConsoleTextAttribute
KERNEL32.dll	540	GetConsoleScreenBufferInfo
KERNEL32.dll	1240	ReleaseSRWLockExclusive
KERNEL32.dll		AcquireSRWLockExclusive
KERNEL32.dll	1460	Sleep
KERNEL32.dll	1136	QueryPerformanceCounter
KERNEL32.dll	1368	SetFileTime
KERNEL32.dll	148	CloseHandle
KERNEL32.dll	399	FindClose
KERNEL32.dll	618	GetFileType
KERNEL32.dll	612	GetFileInformationByHandleEx
KERNEL32.dll	772	GetSystemInfo
KERNEL32.dll	1471	SwitchToThread
KERNEL32.dll	1561	WakeConditionVariable
KERNEL32.dll	1560	WakeAllConditionVariable
KERNEL32.dll	1462	SleepConditionVariableSRW
KERNEL32.dll	20	AddVectoredExceptionHandler
KERNEL32.dll	1431	SetThreadStackGuarantee
KERNEL32.dll	1380	SetLastError
KERNEL32.dll	555	GetCurrentDirectoryW
KERNEL32.dll	597	GetEnvironmentVariableW
KERNEL32.dll	497	GetCommandLineW
KERNEL32.dll	657	GetModuleFileNameW
KERNEL32.dll	1365	SetFilePointerEx
KERNEL32.dll	1501	TryAcquireSRWLockExclusive
KERNEL32.dll	1137	QueryPerformanceFrequency
KERNEL32.dll	562	GetCurrentProcess
KERNEL32.dll	566	GetCurrentThread
KERNEL32.dll	1269	RtlCaptureContext
KERNEL32.dll	717	GetProcAddress
KERNEL32.dll	1277	RtlLookupFunctionEntry
KERNEL32.dll	1237	ReleaseMutex
KERNEL32.dll	1	AcquireSRWLockShared
KERNEL32.dll	1241	ReleaseSRWLockShared
KERNEL32.dll	1553	WaitForSingleObjectEx
KERNEL32.dll	996	LoadLibraryA
KERNEL32.dll	563	GetCurrentProcessId
KERNEL32.dll	231	CreateMutexA
KERNEL32.dll	658	GetModuleHandleA
KERNEL32.dll	422	FindNextFileW
KERNEL32.dll	218	CreateFileW
KERNEL32.dll	611	GetFileInformationByHandle
KERNEL32.dll	201	CreateDirectoryW
KERNEL32.dll	410	FindFirstFileW
KERNEL32.dll	1552	WaitForSingleObject
KERNEL32.dll	661	GetModuleHandleW
KERNEL32.dll	449	FormatMessageW
KERNEL32.dll	376	ExitProcess
KERNEL32.dll	629	GetFullPathNameW
KERNEL32.dll	1042	MultiByteToWideChar
KERNEL32.dll	1610	WriteConsoleW
KERNEL32.dll	1591	WideCharToMultiByte
KERNEL32.dll	1173	ReadConsoleW
KERNEL32.dll	259	CreateThread
KERNEL32.dll	936	IsProcessorFeaturePresent
KERNEL32.dll	1444	SetUnhandledExceptionFilter
KERNEL32.dll	1510	UnhandledExceptionFilter
KERNEL32.dll	928	IsDebuggerPresent
KERNEL32.dll	1284	RtlVirtualUnwind
KERNEL32.dll	906	InitializeSListHead
KERNEL32.dll	778	GetSystemTimeAsFileTime
KERNEL32.dll	567	GetCurrentThreadId
KERNEL32.dll	1476	TerminateProcess
bcrypt.dll	28	BCryptGenRandom
ntdll.dll	75	RtlNtStatusToDosError
ntdll.dll	674	NtWriteFile
ntdll.dll	532	NtReadFile
VCRUNTIME140.dll	1	_CxxThrowException
VCRUNTIME140.dll	59	memcmp
VCRUNTIME140.dll	27	__current_exception
VCRUNTIME140.dll	28	__current_exception_context
VCRUNTIME140.dll	8	__C_specific_handler
VCRUNTIME140.dll	62	memset
VCRUNTIME140.dll	60	memcpy
VCRUNTIME140.dll	14	__CxxFrameHandler3
VCRUNTIME140.dll	61	memmove
api-ms-win-crt-math-l1-1-0.dll	265	round
api-ms-win-crt-math-l1-1-0.dll	218	log
api-ms-win-crt-math-l1-1-0.dll	9	__setusermatherr
api-ms-win-crt-heap-l1-1-0.dll	25	malloc
api-ms-win-crt-heap-l1-1-0.dll	22	_set_new_mode
api-ms-win-crt-heap-l1-1-0.dll	24	free
api-ms-win-crt-runtime-l1-1-0.dll	85	exit
api-ms-win-crt-runtime-l1-1-0.dll	4	__p___argc
api-ms-win-crt-runtime-l1-1-0.dll	5	__p___argv
api-ms-win-crt-runtime-l1-1-0.dll	22	_cexit
api-ms-win-crt-runtime-l1-1-0.dll	66	_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll	61	_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll	40	_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	55	_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll	54	_initterm
api-ms-win-crt-runtime-l1-1-0.dll	52	_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll	60	_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll	30	_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll	103	terminate
api-ms-win-crt-runtime-l1-1-0.dll	35	_exit
api-ms-win-crt-runtime-l1-1-0.dll	51	_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll	64	_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll	24	_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll	21	_c_exit
api-ms-win-crt-stdio-l1-1-0.dll	84	_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll	1	__p__commode
api-ms-win-crt-locale-l1-1-0.dll	8	_configthreadlocale

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	1605680	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x17f664