filenameD2 ESP.exe
size41984 (0xa400)
md5fa072ff1f802d9f82b416f919b5464ae
typePE32+ executable (console) x86-64, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xf8

Rich Header

lib idversiontimes used
1473072914
2613003430
2603003410
259300344
257300346
2573079513
10143
265301532
255301531
258301531

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x8664
NumberOfSections6
TimeDateStamp0x663a798b
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xf0
Characteristics0x22
Magic0x20b
LinkerVersion14.29
SizeOfCode0x6000
SizeOfInitializedData0x4800
SizeOfUninitializedData0
AddressOfEntryPoint0x5f48
BaseOfCode0x1000
ImageBase0x140000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0xf000
SizeOfHeaders0x400
CheckSum0
Subsystem3
DllCharacteristics0x8160
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MASM/TASM - sig1(h)

Sections

namevavsizeraw sizeflags
.text0x10000x5fca0x6000R-X CODE
.rdata0x70000x31d80x3200R-- IDATA
.data0xb0000x8f80x200RW- IDATA
.pdata0xc0000x6840x800R-- IDATA
.rsrc0xd0000x1e00x200R-- IDATA
.reloc0xe0000x680x200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0x8f140x154
RESOURCE0xd0000x1e0
EXCEPTION0xc0000x684
SECURITY00
BASERELOC0xe0000x68
DEBUG0x7be00x70
ARCHITECTURE00
GLOBALPTR00
TLS0x7e000x28
LOAD_CONFIG0x7c500x138
Bound_IAT00
IAT0x70000x468
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x1400084400x1400084480x14000b7400x14000750800x300000
typenamesizecp
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll1070OpenProcess
KERNEL32.dll268CreateToolhelp32Snapshot
KERNEL32.dll1460Sleep
KERNEL32.dll1103Process32Next
KERNEL32.dll148CloseHandle
KERNEL32.dll376ExitProcess
KERNEL32.dll1179ReadProcessMemory
KERNEL32.dll1591WideCharToMultiByte
KERNEL32.dll992LeaveCriticalSection
KERNEL32.dll902InitializeCriticalSectionAndSpinCount
KERNEL32.dll291DeleteCriticalSection
KERNEL32.dll1352SetEvent
KERNEL32.dll1260ResetEvent
KERNEL32.dll1029Module32First
KERNEL32.dll206CreateEventW
KERNEL32.dll1031Module32Next
KERNEL32.dll717GetProcAddress
KERNEL32.dll1269RtlCaptureContext
KERNEL32.dll1277RtlLookupFunctionEntry
KERNEL32.dll1284RtlVirtualUnwind
KERNEL32.dll1510UnhandledExceptionFilter
KERNEL32.dll1444SetUnhandledExceptionFilter
KERNEL32.dll562GetCurrentProcess
KERNEL32.dll1476TerminateProcess
KERNEL32.dll936IsProcessorFeaturePresent
KERNEL32.dll928IsDebuggerPresent
KERNEL32.dll1136QueryPerformanceCounter
KERNEL32.dll1553WaitForSingleObjectEx
KERNEL32.dll1552WaitForSingleObject
KERNEL32.dll563GetCurrentProcessId
KERNEL32.dll567GetCurrentThreadId
KERNEL32.dll778GetSystemTimeAsFileTime
KERNEL32.dll906InitializeSListHead
KERNEL32.dll661GetModuleHandleW
KERNEL32.dll1101Process32First
KERNEL32.dll329EnterCriticalSection
USER32.dll273FindWindowA
USER32.dll327GetDesktopWindow
USER32.dll346GetForegroundWindow
USER32.dll644MessageBoxA
USER32.dll289GetAsyncKeyState
USER32.dll922ShowWindow
USER32.dll457GetSystemMetrics
USER32.dll323GetDC
USER32.dll498GetWindowRect
USER32.dll894SetWindowLongPtrA
USER32.dll307GetClientRect
USER32.dll898SetWindowPos
USER32.dll488GetWindowLongA
USER32.dll835SetLayeredWindowAttributes
GDI32.dll651GetDeviceCaps
MSVCP140.dll1462_Thrd_sleep
MSVCP140.dll1460_Thrd_id
MSVCP140.dll1424_Query_perf_counter
MSVCP140.dll1456_Thrd_detach
MSVCP140.dll1484_Xtime_get_ticks
MSVCP140.dll1461_Thrd_join
MSVCP140.dll1249public: __int64 __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputn(char const * __ptr64, __int64) __ptr64

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

MSVCP140.dll1332public: char __cdecl std::basic_ios<char, struct std::char_traits<char> >::widen(char)const __ptr64

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

MSVCP140.dll1121public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::put(char) __ptr64

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

MSVCP140.dll1246public: int __cdecl std::basic_streambuf<char, struct std::char_traits<char> >::sputc(char) __ptr64

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

MSVCP140.dll654void __cdecl std::_Xlength_error(char const * __ptr64)

?_Xlength_error@std@@YAXPEBD@Z

MSVCP140.dll872public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::flush(void) __ptr64

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

MSVCP140.dll1221public: void __cdecl std::basic_ios<char, struct std::char_traits<char> >::setstate(int, bool) __ptr64

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

MSVCP140.dll262public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 (__cdecl*)(class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64)) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

MSVCP140.dll258public: class std::basic_ostream<char, struct std::char_traits<char> > & __ptr64 __cdecl std::basic_ostream<char, struct std::char_traits<char> >::operator<<(unsigned long) __ptr64

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

MSVCP140.dll605unsigned int __cdecl std::_Random_device(void)

?_Random_device@std@@YAIXZ

MSVCP140.dll1358_Cnd_do_broadcast_at_thread_exit
MSVCP140.dll628void __cdecl std::_Throw_C_error(int)

?_Throw_C_error@std@@YAXH@Z

MSVCP140.dll674class std::basic_ostream<char, struct std::char_traits<char> > std::cerr

?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

MSVCP140.dll1425_Query_perf_frequency
MSVCP140.dll629void __cdecl std::_Throw_Cpp_error(int)

?_Throw_Cpp_error@std@@YAXH@Z

MSVCP140.dll1311int __cdecl std::uncaught_exceptions(void)

?uncaught_exceptions@std@@YAHXZ

MSVCP140.dll580public: void __cdecl std::basic_ostream<char, struct std::char_traits<char> >::_Osfx(void) __ptr64

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

MSVCP140.dll692class std::basic_ostream<char, struct std::char_traits<char> > std::cout

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

DWrite.dllDWriteCreateFactory
dwmapi.dll8DwmExtendFrameIntoClientArea
d2d1.dll1
VCRUNTIME140_1.dll__CxxFrameHandler4
VCRUNTIME140.dll61memmove
VCRUNTIME140.dll60memcpy
VCRUNTIME140.dll59memcmp
VCRUNTIME140.dll1_CxxThrowException
VCRUNTIME140.dll62memset
VCRUNTIME140.dll8__C_specific_handler
VCRUNTIME140.dll28__current_exception_context
VCRUNTIME140.dll27__current_exception
VCRUNTIME140.dll35__std_terminate
VCRUNTIME140.dll33__std_exception_copy
VCRUNTIME140.dll58memchr
VCRUNTIME140.dll34__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0.dll21_c_exit
api-ms-win-crt-runtime-l1-1-0.dll20_beginthreadex
api-ms-win-crt-runtime-l1-1-0.dll35_exit
api-ms-win-crt-runtime-l1-1-0.dll55_initterm_e
api-ms-win-crt-runtime-l1-1-0.dll4__p___argc
api-ms-win-crt-runtime-l1-1-0.dll85exit
api-ms-win-crt-runtime-l1-1-0.dll5__p___argv
api-ms-win-crt-runtime-l1-1-0.dll64_seh_filter_exe
api-ms-win-crt-runtime-l1-1-0.dll54_initterm
api-ms-win-crt-runtime-l1-1-0.dll22_cexit
api-ms-win-crt-runtime-l1-1-0.dll30_crt_atexit
api-ms-win-crt-runtime-l1-1-0.dll60_register_onexit_function
api-ms-win-crt-runtime-l1-1-0.dll52_initialize_onexit_table
api-ms-win-crt-runtime-l1-1-0.dll51_initialize_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll24_configure_narrow_argv
api-ms-win-crt-runtime-l1-1-0.dll40_get_initial_narrow_environment
api-ms-win-crt-runtime-l1-1-0.dll61_register_thread_local_exe_atexit_callback
api-ms-win-crt-runtime-l1-1-0.dll103terminate
api-ms-win-crt-runtime-l1-1-0.dll66_set_app_type
api-ms-win-crt-runtime-l1-1-0.dll57_invalid_parameter_noinfo_noreturn
api-ms-win-crt-stdio-l1-1-0.dll3__stdio_common_vfprintf
api-ms-win-crt-stdio-l1-1-0.dll84_set_fmode
api-ms-win-crt-stdio-l1-1-0.dll__acrt_iob_func
api-ms-win-crt-stdio-l1-1-0.dll13__stdio_common_vsprintf
api-ms-win-crt-stdio-l1-1-0.dll1__p__commode
api-ms-win-crt-string-l1-1-0.dll42_stricmp
api-ms-win-crt-string-l1-1-0.dll134strcmp
api-ms-win-crt-convert-l1-1-0.dll91mbstowcs
api-ms-win-crt-heap-l1-1-0.dll24free
api-ms-win-crt-heap-l1-1-0.dll25malloc
api-ms-win-crt-heap-l1-1-0.dll8_callnewh
api-ms-win-crt-heap-l1-1-0.dll22_set_new_mode
api-ms-win-crt-math-l1-1-0.dll9__setusermatherr
api-ms-win-crt-locale-l1-1-0.dll8_configthreadlocale
offsetsizetypecomment
15c115HTM#
15d036400BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xb740