SERIAL.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	SERIAL.exe
size	132548 (0x205c4)
md5	c92cc7e56ab63e7d121df8072fdf2429

type	PE32+ executable (console) x86-64, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x8664
NumberOfSections	0x11
TimeDateStamp	0x6437f820
PointerToSymbolTable	0x18400
NumberOfSymbols	0x5d3
SizeOfOptionalHeader	0xf0
Characteristics	0x27
Magic	0x20b
LinkerVersion	2.24
SizeOfCode	0x1e00
SizeOfInitializedData	0x2000
SizeOfUninitializedData	0xc00
AddressOfEntryPoint	0x1500
BaseOfCode	0x1000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.2
Reserved1	0
SizeOfImage	0x22000
SizeOfHeaders	0x600
CheckSum	0x2c67b
Subsystem	3
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1ce0	0x1e00	R-X CODE
.data	0x3000	0x90	0x200	RW- IDATA
.rdata	0x4000	0x8a0	0xa00	R-- IDATA
.pdata	0x5000	0x234	0x400	R-- IDATA
.xdata	0x6000	0x1f8	0x200	R-- IDATA
.bss	0x7000	0xa60	0	RW- UDATA
.idata	0x8000	0x820	0xa00	RW- IDATA
.CRT	0x9000	0x68	0x200	RW- IDATA
.tls	0xa000	0x68	0x200	RW- IDATA
/4	0xb000	0x420	0x600	R-- IDATA DISCARDABLE
/19	0xc000	0xbe7a	0xc000	R-- IDATA DISCARDABLE
/31	0x18000	0x1a3c	0x1c00	R-- IDATA DISCARDABLE
/45	0x1a000	0x19b5	0x1a00	R-- IDATA DISCARDABLE
/57	0x1c000	0xae0	0xc00	R-- IDATA DISCARDABLE
/70	0x1d000	0x300	0x400	R-- IDATA DISCARDABLE
/81	0x1e000	0x2c04	0x2e00	R-- IDATA DISCARDABLE
/92	0x21000	0x520	0x600	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x8000	0x820
RESOURCE	0	0
EXCEPTION	0x5000	0x234
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xa020	0x28
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x8204	0x1c8
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x40a000	0x40a060	0x40794c	0x409040	0	0

module_name	hint	function_name
KERNEL32.dll	216	DeleteCriticalSection
KERNEL32.dll	248	EnterCriticalSection
KERNEL32.dll	461	GetCurrentProcess
KERNEL32.dll	462	GetCurrentProcessId
KERNEL32.dll	466	GetCurrentThreadId
KERNEL32.dll	528	GetLastError
KERNEL32.dll	627	GetStartupInfoA
KERNEL32.dll	650	GetSystemTimeAsFileTime
KERNEL32.dll	677	GetTickCount
KERNEL32.dll	761	InitializeCriticalSection
KERNEL32.dll	843	LeaveCriticalSection
KERNEL32.dll	955	QueryPerformanceCounter
KERNEL32.dll	1025	RtlAddFunctionTable
KERNEL32.dll	1026	RtlCaptureContext
KERNEL32.dll	1033	RtlLookupFunctionEntry
KERNEL32.dll	1040	RtlVirtualUnwind
KERNEL32.dll	1183	SetUnhandledExceptionFilter
KERNEL32.dll	1196	Sleep
KERNEL32.dll	1210	TerminateProcess
KERNEL32.dll	1217	TlsGetValue
KERNEL32.dll	1230	UnhandledExceptionFilter
KERNEL32.dll	1260	VirtualProtect
KERNEL32.dll	1262	VirtualQuery
msvcrt.dll	55	__C_specific_handler
msvcrt.dll	78	__dllonexit
msvcrt.dll	81	__getmainargs
msvcrt.dll	82	__initenv
msvcrt.dll	83	__iob_func
msvcrt.dll	90	__lconv_init
msvcrt.dll	96	__set_app_type
msvcrt.dll	98	__setusermatherr
msvcrt.dll	116	_acmdln
msvcrt.dll	123	_amsg_exit
msvcrt.dll	141	_cexit
msvcrt.dll	253	_fmode
msvcrt.dll	329	_initterm
msvcrt.dll	441	_lock
msvcrt.dll	610	_onexit
msvcrt.dll	818	_unlock
msvcrt.dll	1030	abort
msvcrt.dll	1044	calloc
msvcrt.dll	1055	exit
msvcrt.dll	1064	fgets
msvcrt.dll	1072	fprintf
msvcrt.dll	1079	free
msvcrt.dll	1090	fwrite
msvcrt.dll	1137	malloc
msvcrt.dll	1145	memcpy
msvcrt.dll	1152	printf
msvcrt.dll	1156	puts
msvcrt.dll	1174	signal
msvcrt.dll	1186	strcmp
msvcrt.dll	1193	strlen
msvcrt.dll	1196	strncmp
msvcrt.dll	1227	vfprintf

show previews

offset	size	type	comment
0	132548	EXE	04/13/2023 12:40:00	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x794c