filenamekontroll.exe
size7427584 (0x715600)
md5bd9294581045f674dca6fc8c4fa4a006
typePE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections0xa
TimeDateStamp0x56b2a443
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22f
Magic0x20b
LinkerVersion2.22
SizeOfCode0x11800
SizeOfInitializedData0x703a00
SizeOfUninitializedData0xe00
AddressOfEntryPoint0x14d0
BaseOfCode0x1000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion5.2
Reserved10
SizeOfImage0x71d000
SizeOfHeaders0x400
CheckSum0x719c73
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x1000000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000x116e00x11800R-X CODE
.data0x130000x4500x600RW- IDATA
.rdata0x140000x40300x4200R-- IDATA
.pdata0x190000x93c0xa00R-- IDATA
.xdata0x1a0000x9040xa00R-- IDATA
.bss0x1b0000xcc00RW- UDATA
.idata0x1c0000x13180x1400RW- IDATA
.CRT0x1e0000x700x200RW- IDATA
.tls0x1f0000x480x200RW- IDATA
.rsrc0x200000x6fc5400x6fc600RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1c0000x1318
RESOURCE0x200000x6fc540
EXCEPTION0x190000x93c
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x1f0000x28
LOAD_CONFIG00
Bound_IAT00
IAT0x1c4e40x458
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x41f0410x41f0440x41b78c0x41e04800
typenamesizecp
BFS#173196521252
ICON#132401252
STRING#1321252
GROUP_ICON!201252
VERSION#17241252
MANIFEST#18411252
module_namehintordfunction_name
ADVAPI32.dll356GetUserNameA
COMCTL32.dll92InitCommonControls
KERNEL32.dll85CloseHandle
KERNEL32.dll140CreateFileA
KERNEL32.dll215DeleteCriticalSection
KERNEL32.dll247EnterCriticalSection
KERNEL32.dll293ExitThread
KERNEL32.dll313FindClose
KERNEL32.dll317FindFirstFileA
KERNEL32.dll334FindNextFileA
KERNEL32.dll342FindResourceA
KERNEL32.dll365FreeLibrary
KERNEL32.dll408GetComputerNameA
KERNEL32.dll460GetCurrentProcess
KERNEL32.dll461GetCurrentProcessId
KERNEL32.dll465GetCurrentThreadId
KERNEL32.dll506GetFileInformationByHandle
KERNEL32.dll527GetLastError
KERNEL32.dll545GetModuleFileNameA
KERNEL32.dll547GetModuleHandleA
KERNEL32.dll597GetProcAddress
KERNEL32.dll625GetShortPathNameW
KERNEL32.dll626GetStartupInfoA
KERNEL32.dll649GetSystemTimeAsFileTime
KERNEL32.dll660GetTempPathA
KERNEL32.dll675GetTickCount
KERNEL32.dll692GetVersionExA
KERNEL32.dll759InitializeCriticalSection
KERNEL32.dll841LeaveCriticalSection
KERNEL32.dll844LoadLibraryA
KERNEL32.dll845LoadLibraryExA
KERNEL32.dll847LoadLibraryW
KERNEL32.dll849LoadResource
KERNEL32.dll868LockResource
KERNEL32.dll887MultiByteToWideChar
KERNEL32.dll922OutputDebugStringA
KERNEL32.dll952QueryPerformanceCounter
KERNEL32.dll1022RtlAddFunctionTable
KERNEL32.dll1023RtlCaptureContext
KERNEL32.dll1027RtlDeleteFunctionTable
KERNEL32.dll1030RtlLookupFunctionEntry
KERNEL32.dll1037RtlVirtualUnwind
KERNEL32.dll1101SetEnvironmentVariableA
KERNEL32.dll1121SetFileTime
KERNEL32.dll1129SetLastError
KERNEL32.dll1180SetUnhandledExceptionFilter
KERNEL32.dll1193Sleep
KERNEL32.dll1204SystemTimeToFileTime
KERNEL32.dll1207TerminateProcess
KERNEL32.dll1214TlsGetValue
KERNEL32.dll1227UnhandledExceptionFilter
KERNEL32.dll1251VirtualAlloc
KERNEL32.dll1254VirtualFree
KERNEL32.dll1257VirtualProtect
KERNEL32.dll1259VirtualQuery
KERNEL32.dll1291WideCharToMultiByte
KERNEL32.dll1327__C_specific_handler
msvcrt.dll3_chmod
msvcrt.dll10_dup2
msvcrt.dll26_fileno
msvcrt.dll35_getpid
msvcrt.dll51_mkdir
msvcrt.dll58_putenv
msvcrt.dll61_rmdir
msvcrt.dll76_strdup
msvcrt.dll77_stricmp
msvcrt.dll80_strnicmp
msvcrt.dll93_unlink
msvcrt.dll78__dllonexit
msvcrt.dll81__getmainargs
msvcrt.dll82__initenv
msvcrt.dll83__iob_func
msvcrt.dll90__lconv_init
msvcrt.dll96__set_app_type
msvcrt.dll98__setusermatherr
msvcrt.dll114_acmdln
msvcrt.dll121_amsg_exit
msvcrt.dll139_cexit
msvcrt.dll196_environ
msvcrt.dll198_errno
msvcrt.dll207_exit
msvcrt.dll231_fmode
msvcrt.dll297_initterm
msvcrt.dll398_localtime64
msvcrt.dll400_lock
msvcrt.dll566_onexit
msvcrt.dll612_setjmp
msvcrt.dll655_stat64
msvcrt.dll710_time64
msvcrt.dll734_unlock
msvcrt.dll934abort
msvcrt.dll944atoi
msvcrt.dll945atol
msvcrt.dll948calloc
msvcrt.dll958exit
msvcrt.dll960fclose
msvcrt.dll963fflush
msvcrt.dll966fgets
msvcrt.dll971fopen
msvcrt.dll973fprintf
msvcrt.dll975fputc
msvcrt.dll976fputs
msvcrt.dll979fread
msvcrt.dll980free
msvcrt.dll991fwrite
msvcrt.dll996getenv
msvcrt.dll1035longjmp
msvcrt.dll1036malloc
msvcrt.dll1043memcmp
msvcrt.dll1044memcpy
msvcrt.dll1046memmove
msvcrt.dll1048memset
msvcrt.dll1051perror
msvcrt.dll1061raise
msvcrt.dll1062rand
msvcrt.dll1074signal
msvcrt.dll1077sprintf
msvcrt.dll1080srand
msvcrt.dll1083strcat
msvcrt.dll1085strchr
msvcrt.dll1086strcmp
msvcrt.dll1088strcpy
msvcrt.dll1094strlen
msvcrt.dll1097strncmp
msvcrt.dll1098strncpy
msvcrt.dll1102strrchr
msvcrt.dll1104strstr
msvcrt.dll1124toupper
msvcrt.dll1129vfprintf
msvcrt.dll1135vsprintf
msvcrt.dll1145wcscmp
msvcrt.dll1151wcslen
USER32.dll485MessageBoxA

StringTable 000004B0

CompanyNameNVB/Unit.no
FileDescription
FileVersion19.20.0.0
ProductNameNVB-Kontrollprogram
ProductVersion19.20.0.0
LegalCopyrightNVB/Unit.no
LegalTrademarks
OriginalFilenamekontroll.exe
InternalNameKontrollmotor

VS_FIXEDFILEINFO

FileVersion19.20.0.0
ProductVersion19.20.0.0
StrucVersion0x10000
FileFlagsMask0
FileFlags0
FileOS0
FileType0
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d07422000BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x1b78c