filenamecvdump.exe
size979968 (0xef400)
md5fcdb51ced35a8d679e91b912b6838433
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x118

Rich Header

lib idversiontimes used
206655014
2414011611
24340116170
2424011625
199411181
2612352496
2602352420
2592352422
2036550111
10132
2642352411
255235241
258235241

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x569ef88c
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x122
Magic0x10b
LinkerVersion14.0
SizeOfCode0xdec00
SizeOfInitializedData0x10400
SizeOfUninitializedData0
AddressOfEntryPoint0x51354
BaseOfCode0x1000
BaseOfData0xe0000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion10.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x106000
SizeOfHeaders0x400
CheckSum0xf86bb
Subsystem3
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000xdeac40xdec00R-X CODE
.data0xe00000x143100x2a00RW- IDATA
.idata0xf50000xb3e0xc00R-- IDATA
.gfids0xf60000x1300x200R-- IDATA
.tls0xf700090x200RW- IDATA
.rsrc0xf80000x7480x800R-- IDATA
.reloc0xf90000xc1b00xc200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xf51b00x78
RESOURCE0xf80000x748
EXCEPTION00
SECURITY00
BASERELOC0xf90000xc1b0
DEBUG0x30c800x38
ARCHITECTURE00
GLOBALPTR00
TLS0x30d140x18
LOAD_CONFIG0x30cb80x40
Bound_IAT00
IAT0xf50000x1b0
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4f70000x4f70080x4e3bd80x40107c00x300000
typenamesizecp
VERSION#19721252
MANIFEST#17301252
module_namehintordfunction_name
KERNEL32.dll182CreateEventW
KERNEL32.dll1185ResetEvent
KERNEL32.dll946LocalFree
KERNEL32.dll574GetFileType
KERNEL32.dll494GetConsoleMode
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll669GetProcAddress
KERNEL32.dll977MultiByteToWideChar
KERNEL32.dll1263SetEvent
KERNEL32.dll1290SetLastError
KERNEL32.dll1408UnhandledExceptionFilter
KERNEL32.dll1345SetUnhandledExceptionFilter
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll1375TerminateProcess
KERNEL32.dll877IsProcessorFeaturePresent
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll843InitializeSListHead
KERNEL32.dll871IsDebuggerPresent
KERNEL32.dll702GetStartupInfoW
KERNEL32.dll592GetLastError
KERNEL32.dll611GetModuleFileNameW
KERNEL32.dll1087RaiseException
KERNEL32.dll840InitializeCriticalSectionAndSpinCount
KERNEL32.dll1393TlsAlloc
KERNEL32.dll1395TlsGetValue
KERNEL32.dll1396TlsSetValue
KERNEL32.dll1394TlsFree
KERNEL32.dll414FreeLibrary
KERNEL32.dll935LoadLibraryExW
KERNEL32.dll1196RtlUnwind
KERNEL32.dll293EnterCriticalSection
KERNEL32.dll930LeaveCriticalSection
KERNEL32.dll261DeleteCriticalSection
KERNEL32.dll337ExitProcess
KERNEL32.dll614GetModuleHandleExW
KERNEL32.dll1103ReadFile
KERNEL32.dll1101ReadConsoleW
KERNEL32.dll127CloseHandle
KERNEL32.dll194CreateFileW
KERNEL32.dll1276SetFilePointerEx
KERNEL32.dll1312SetStdHandle
KERNEL32.dll1502WriteConsoleW
KERNEL32.dll704GetStdHandle
KERNEL32.dll1503WriteFile
KERNEL32.dll1483WideCharToMultiByte
KERNEL32.dll456GetCommandLineA
KERNEL32.dll457GetCommandLineW
KERNEL32.dll420GetACP
KERNEL32.dll819HeapFree
KERNEL32.dll815HeapAlloc
KERNEL32.dll147CompareStringW
KERNEL32.dll918LCMapStringW
KERNEL32.dll402FlushFileBuffers
KERNEL32.dll476GetConsoleCP
KERNEL32.dll709GetStringTypeW
KERNEL32.dll1257SetEndOfFile
KERNEL32.dll822HeapReAlloc
KERNEL32.dll1450WaitForSingleObjectEx
KERNEL32.dll360FindClose
KERNEL32.dll366FindFirstFileExW
KERNEL32.dll383FindNextFileW
KERNEL32.dll882IsValidCodePage
KERNEL32.dll646GetOEMCP
KERNEL32.dll435GetCPInfo
KERNEL32.dll551GetEnvironmentStringsW
KERNEL32.dll413FreeEnvironmentStringsW
KERNEL32.dll1260SetEnvironmentVariableA
KERNEL32.dll1261SetEnvironmentVariableW
KERNEL32.dll674GetProcessHeap
KERNEL32.dll761GetTimeZoneInformation
KERNEL32.dll824HeapSize
KERNEL32.dll254DecodePointer
KERNEL32.dll565GetFileAttributesW
KERNEL32.dll1270SetFileAttributesW
KERNEL32.dll1433VirtualAlloc
KERNEL32.dll1436VirtualFree
KERNEL32.dll266DeleteFileW
KERNEL32.dll274DeviceIoControl
KERNEL32.dll191CreateFileMappingW
KERNEL32.dll341ExpandEnvironmentStringsW
KERNEL32.dll585GetFullPathNameW
KERNEL32.dll543GetDriveTypeW
KERNEL32.dll1275SetFilePointer
KERNEL32.dll961MapViewOfFileEx
KERNEL32.dll405FlushViewOfFile
KERNEL32.dll1411UnmapViewOfFile
KERNEL32.dll720GetSystemInfo
KERNEL32.dll942LocalAlloc
KERNEL32.dll515GetCurrentDirectoryW
ole32.dll123CoTaskMemFree
ole32.dll442StringFromGUID2
ole32.dll443StringFromIID
OLEAUT32.dll6
OLEAUT32.dll232
OLEAUT32.dll114
ADVAPI32.dll658RegQueryValueExW
ADVAPI32.dll645RegOpenKeyExW
ADVAPI32.dll596RegCloseKey
ADVAPI32.dll794SystemFunction036
RPCRT4.dll522UuidCreate

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionMicrosoft® Debugging Information Dumper
FileVersion14.00.23611.0 built by: WINCCOMP(CPPBUILD-16-11-VCWRKSPC)
InternalNameCVDUMP.EXE
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameCVDUMP.EXE
ProductNameMicrosoft® Visual Studio® 2015
ProductVersion14.00.23611.0

VS_FIXEDFILEINFO

FileVersion14.0.23611.0
ProductVersion14.0.23611.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
0979968EXE01/20/2016 03:01:32#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0xe3bd8