MarbleMarcher.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	MarbleMarcher.exe
size	2253824 (0x226400)
md5	c3dd83b707a4bbd49509f3f5d6599045

type	PE32+ executable (GUI) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x130

Rich Header

lib id	version	times used
260	24610	28
259	24610	25
261	24610	176
199	41118	2
259	24123	21
261	24123	59
260	24123	39
260	23026	50
257	25019	2
224	31101	32
257	24610	13
1	0	265
261	24215	85
255	24210	1
151	0	1
258	24215	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	9
TimeDateStamp	0x5c5c0fd9
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xf0
Characteristics	0x22
Magic	0x20b
LinkerVersion	14.0
SizeOfCode	0x117600
SizeOfInitializedData	0x113e00
SizeOfUninitializedData	0
AddressOfEntryPoint	0xe9344
BaseOfCode	0x1000
ImageBase	0x140000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x231000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0x8160
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1174bd	0x117600	R-X CODE
.rdata	0x119000	0xe0222	0xe0400	R-- IDATA
.data	0x1fa000	0x7ea4	0x2c00	RW- IDATA
.pdata	0x202000	0xe5ec	0xe600	R-- IDATA
.gfids	0x211000	0x150	0x200	R-- IDATA
.tls	0x212000	9	0x200	RW- IDATA
_RDATA	0x213000	0x9f30	0xa000	R-- IDATA
.rsrc	0x21d000	0xf6a8	0xf800	R-- IDATA
.reloc	0x22d000	0x37a8	0x3800	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1f7a94	0xa0
RESOURCE	0x21d000	0xf6a8
EXCEPTION	0x202000	0xe5ec
SECURITY	0	0
BASERELOC	0x22d000	0x37a8
DEBUG	0x1dcb50	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x1dcc08	0x28
LOAD_CONFIG	0x1dcb70	0x94
Bound_IAT	0	0
IAT	0x119000	0x718
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x140212000	0x140212008	0x140201108	0x140119890	0	0x300000

show previews

type	name	size
ICON	#1	62474
GROUP_ICON	MAIN_ICON	20
MANIFEST	#1	381

module_name	hint	function_name
KERNEL32.dll	239	CreateThread
KERNEL32.dll	353	ExitThread
KERNEL32.dll	608	GetLastError
KERNEL32.dll	179	CreateDirectoryA
KERNEL32.dll	1494	WaitForSingleObject
KERNEL32.dll	847	HeapSize
KERNEL32.dll	1295	SetEndOfFile
KERNEL32.dll	1298	SetEnvironmentVariableA
KERNEL32.dll	428	FreeEnvironmentStringsW
KERNEL32.dll	568	GetEnvironmentStringsW
KERNEL32.dll	473	GetCommandLineW
KERNEL32.dll	472	GetCommandLineA
KERNEL32.dll	663	GetOEMCP
KERNEL32.dll	901	IsValidCodePage
KERNEL32.dll	396	FindNextFileA
KERNEL32.dll	380	FindFirstFileExA
KERNEL32.dll	375	FindClose
KERNEL32.dll	782	GetTimeZoneInformation
KERNEL32.dll	692	GetProcessHeap
KERNEL32.dll	1127	ReadConsoleW
KERNEL32.dll	1352	SetStdHandle
KERNEL32.dll	602	GetFullPathNameW
KERNEL32.dll	531	GetCurrentDirectoryW
KERNEL32.dll	1314	SetFilePointerEx
KERNEL32.dll	510	GetConsoleMode
KERNEL32.dll	492	GetConsoleCP
KERNEL32.dll	417	FlushFileBuffers
KERNEL32.dll	341	EnumSystemLocalesW
KERNEL32.dll	787	GetUserDefaultLCID
KERNEL32.dll	903	IsValidLocale
KERNEL32.dll	436	GetACP
KERNEL32.dll	1556	WriteFile
KERNEL32.dll	626	GetModuleFileNameA
KERNEL32.dll	845	HeapReAlloc
KERNEL32.dll	842	HeapFree
KERNEL32.dll	838	HeapAlloc
KERNEL32.dll	630	GetModuleHandleExW
KERNEL32.dll	352	ExitProcess
KERNEL32.dll	1129	ReadFile
KERNEL32.dll	364	FileTimeToSystemTime
KERNEL32.dll	1415	SystemTimeToTzSpecificLocalTime
KERNEL32.dll	1048	PeekNamedPipe
KERNEL32.dll	584	GetFileInformationByHandle
KERNEL32.dll	560	GetDriveTypeW
KERNEL32.dll	1091	QueryPerformanceCounter
KERNEL32.dll	1092	QueryPerformanceFrequency
KERNEL32.dll	794	GetVersion
KERNEL32.dll	1403	Sleep
KERNEL32.dll	862	InitializeCriticalSection
KERNEL32.dll	306	EnterCriticalSection
KERNEL32.dll	949	LeaveCriticalSection
KERNEL32.dll	270	DeleteCriticalSection
KERNEL32.dll	628	GetModuleHandleA
KERNEL32.dll	631	GetModuleHandleW
KERNEL32.dll	686	GetProcAddress
KERNEL32.dll	425	FormatMessageW
KERNEL32.dll	429	FreeLibrary
KERNEL32.dll	956	LoadLibraryW
KERNEL32.dll	953	LoadLibraryA
KERNEL32.dll	966	LocalFree
KERNEL32.dll	722	GetStdHandle
KERNEL32.dll	201	CreateFileW
KERNEL32.dll	591	GetFileType
KERNEL32.dll	997	MultiByteToWideChar
KERNEL32.dll	1536	WideCharToMultiByte
KERNEL32.dll	1555	WriteConsoleW
KERNEL32.dll	727	GetStringTypeW
KERNEL32.dll	302	EncodePointer
KERNEL32.dll	263	DecodePointer
KERNEL32.dll	1328	SetLastError
KERNEL32.dll	863	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	189	CreateEventW
KERNEL32.dll	1436	TlsAlloc
KERNEL32.dll	1438	TlsGetValue
KERNEL32.dll	1439	TlsSetValue
KERNEL32.dll	1437	TlsFree
KERNEL32.dll	745	GetSystemTimeAsFileTime
KERNEL32.dll	153	CompareStringW
KERNEL32.dll	937	LCMapStringW
KERNEL32.dll	612	GetLocaleInfoW
KERNEL32.dll	451	GetCPInfo
KERNEL32.dll	1220	RtlCaptureContext
KERNEL32.dll	1227	RtlLookupFunctionEntry
KERNEL32.dll	1234	RtlVirtualUnwind
KERNEL32.dll	1452	UnhandledExceptionFilter
KERNEL32.dll	1388	SetUnhandledExceptionFilter
KERNEL32.dll	537	GetCurrentProcess
KERNEL32.dll	1418	TerminateProcess
KERNEL32.dll	896	IsProcessorFeaturePresent
KERNEL32.dll	133	CloseHandle
KERNEL32.dll	1301	SetEvent
KERNEL32.dll	1212	ResetEvent
KERNEL32.dll	1495	WaitForSingleObjectEx
KERNEL32.dll	889	IsDebuggerPresent
KERNEL32.dll	720	GetStartupInfoW
KERNEL32.dll	538	GetCurrentProcessId
KERNEL32.dll	542	GetCurrentThreadId
KERNEL32.dll	867	InitializeSListHead
KERNEL32.dll	1229	RtlPcToFileHeader
KERNEL32.dll	1113	RaiseException
KERNEL32.dll	1233	RtlUnwindEx
KERNEL32.dll	955	LoadLibraryExW
KERNEL32.dll	430	FreeLibraryAndExitThread
USER32.dll	114	CreateWindowExA
USER32.dll	177	DestroyWindow
USER32.dll	885	ShowWindow
USER32.dll	910	TrackMouseEvent
USER32.dll	917	TranslateMessage
USER32.dll	185	DispatchMessageW
USER32.dll	672	PeekMessageW
USER32.dll	776	SendMessageW
USER32.dll	726	RegisterDeviceNotificationW
USER32.dll	164	DefWindowProcW
USER32.dll	32	CallWindowProcW
USER32.dll	721	RegisterClassW
USER32.dll	928	UnregisterClassW
USER32.dll	115	CreateWindowExW
USER32.dll	273	FlashWindowEx
USER32.dll	868	SetWindowPos
USER32.dll	352	GetKeyState
USER32.dll	628	MapVirtualKeyW
USER32.dll	288	GetCapture
USER32.dll	780	SetCapture
USER32.dll	749	ReleaseCapture
USER32.dll	336	GetForegroundWindow
USER32.dll	807	SetForegroundWindow
USER32.dll	873	SetWindowTextW
USER32.dll	302	GetClientRect
USER32.dll	479	GetWindowRect
USER32.dll	2	AdjustWindowRect
USER32.dll	880	ShowCursor
USER32.dll	792	SetCursor
USER32.dll	629	MapWindowPoints
USER32.dll	76	ClipCursor
USER32.dll	473	GetWindowLongW
USER32.dll	866	SetWindowLongW
USER32.dll	472	GetWindowLongPtrW
USER32.dll	865	SetWindowLongPtrW
USER32.dll	487	GetWindowThreadProcessId
USER32.dll	105	CreateIcon
USER32.dll	174	DestroyIcon
USER32.dll	40	ChangeDisplaySettingsW
USER32.dll	579	LoadCursorW
USER32.dll	750	ReleaseDC
USER32.dll	253	EnumDisplaySettingsW
USER32.dll	761	ScreenToClient
USER32.dll	75	ClientToScreen
USER32.dll	794	SetCursorPos
USER32.dll	634	MessageBoxA
USER32.dll	317	GetDC
OPENGL32.dll	308	glTexImage2D
OPENGL32.dll	181	glMatrixMode
OPENGL32.dll	166	glLoadMatrixf
OPENGL32.dll	164	glLoadIdentity
OPENGL32.dll	130	glGetTexImage
OPENGL32.dll	97	glFlush
OPENGL32.dll	360	wglShareLists
OPENGL32.dll	356	wglMakeCurrent
OPENGL32.dll	355	wglGetProcAddress
OPENGL32.dll	347	wglDeleteContext
OPENGL32.dll	11	glBindTexture
OPENGL32.dll	62	glCopyTexSubImage2D
OPENGL32.dll	66	glDeleteTextures
OPENGL32.dll	105	glGenTextures
OPENGL32.dll	314	glTexSubImage2D
OPENGL32.dll	13	glBlendFunc
OPENGL32.dll	16	glClear
OPENGL32.dll	18	glClearColor
OPENGL32.dll	70	glDisable
OPENGL32.dll	342	glViewport
OPENGL32.dll	57	glColorPointer
OPENGL32.dll	71	glDisableClientState
OPENGL32.dll	72	glDrawArrays
OPENGL32.dll	80	glEnableClientState
OPENGL32.dll	79	glEnable
OPENGL32.dll	109	glGetError
OPENGL32.dll	111	glGetIntegerv
OPENGL32.dll	124	glGetString
OPENGL32.dll	150	glIsEnabled
OPENGL32.dll	345	wglCreateContext
OPENGL32.dll	341	glVertexPointer
OPENGL32.dll	296	glTexCoordPointer
OPENGL32.dll	311	glTexParameteri
WINMM.dll	19	joyGetDevCapsW
WINMM.dll	134	timeBeginPeriod
WINMM.dll	136	timeGetDevCaps
WINMM.dll	22	joyGetPosEx
WINMM.dll	135	timeEndPeriod
OpenAL32.dll	19	alDeleteSources
OpenAL32.dll	121	alSourcef
OpenAL32.dll	123	alSourcei
OpenAL32.dll	84	alGetSourcei
OpenAL32.dll	111	alSourcePlay
OpenAL32.dll	116	alSourceStop
OpenAL32.dll	109	alSourcePause
OpenAL32.dll	113	alSourceQueueBuffers
OpenAL32.dll	118	alSourceUnqueueBuffers
OpenAL32.dll	34	alGenBuffers
OpenAL32.dll	16	alDeleteBuffers
OpenAL32.dll	6	alBufferData
OpenAL32.dll	49	alGetBufferi
OpenAL32.dll	57	alGetEnumValue
OpenAL32.dll	100	alListenerf
OpenAL32.dll	98	alListener3f
OpenAL32.dll	101	alListenerfv
OpenAL32.dll	134	alcCreateContext
OpenAL32.dll	152	alcMakeContextCurrent
OpenAL32.dll	135	alcDestroyContext
OpenAL32.dll	153	alcOpenDevice
OpenAL32.dll	133	alcCloseDevice
OpenAL32.dll	37	alGenSources
GDI32.dll	25	ChoosePixelFormat
GDI32.dll	859	SetPixelFormat
GDI32.dll	886	SwapBuffers
GDI32.dll	650	GetPixelFormat
GDI32.dll	346	DescribePixelFormat
GDI32.dll	592	GetDeviceCaps
ADVAPI32.dll	601	RegCloseKey
ADVAPI32.dll	663	RegQueryValueExW
ADVAPI32.dll	650	RegOpenKeyExW

show previews

offset	size	type	comment
15c1	15	HTM		#
213500	62474	PNG	(222 x 256)	#
22290a	15094	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x201108