Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 2018-May-16 13:43:48 |
Detected languages |
English - United States
|
Debug artifacts |
C:\Users\tgroben\Downloads\Castle-master\Castle\Release\Castle.pdb
|
Info | Matching compiler(s): | Microsoft Visual C++ 6.0 - 8.0 |
Suspicious | The PE contains functions most legitimate programs don't use. |
Functions which can be used for anti-debugging purposes:
|
Suspicious | VirusTotal score: 1/64 (Scanned on 2018-05-16 13:48:33) | ESET-NOD32: a variant of Win32/GameHack.CAA potentially unsafe |
e_magic | MZ |
---|---|
e_cblp | 0x90 |
e_cp | 0x3 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0 |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0 |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0xf8 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 8 |
TimeDateStamp | 2018-May-16 13:43:48 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
|
Magic | PE32 |
---|---|
LinkerVersion | 14.0 |
SizeOfCode | 0x1ff400 |
SizeOfInitializedData | 0x122400 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x00001E3D (Section: .text) |
BaseOfCode | 0x1000 |
BaseOfData | 0x201000 |
ImageBase | 0x10000000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 6.0 |
ImageVersion | 0.0 |
SubsystemVersion | 6.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x327000 |
SizeOfHeaders | 0x400 |
Checksum | 0 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x1000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
KERNEL32.dll |
FreeConsole
SetConsoleTitleA AllocConsole CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleA GetProcAddress GetCurrentProcess K32GetModuleInformation QueryPerformanceCounter QueryPerformanceFrequency VirtualProtect CreateDirectoryA GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW CreateEventW WaitForSingleObjectEx ResetEvent SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CloseHandle InitializeSListHead |
---|---|
USER32.dll |
GetAsyncKeyState
SetWindowLongA CallWindowProcA SetCursor GetClientRect GetKeyState FlashWindowEx FindWindowA |
SHELL32.dll |
SHGetFolderPathA
|
MSVCP140.dll |
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ ??Bid@locale@std@@QAEIXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?is@?$ctype@_W@std@@QBE_NF_W@Z ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ??Bios_base@std@@QBE_NXZ ?width@ios_base@std@@QBE_JXZ ?width@ios_base@std@@QAE_J_J@Z ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ ?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?_BADOFF@std@@3_JB ?id@?$ctype@_W@std@@2V0locale@2@A _Xtime_get_ticks _Thrd_sleep ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QBE_NXZ ?flags@ios_base@std@@QBEHXZ ?setf@ios_base@std@@QAEHH@Z ?setf@ios_base@std@@QAEHHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??7ios_base@std@@QBE_NXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Getmonths@_Locinfo@std@@QBEPBDXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xinvalid_argument@std@@YAXPBD@Z ??4?$_Yarn@D@std@@QAEAAV01@PBD@Z ?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z ?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ ?widen@?$ctype@_W@std@@QBE_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?_W_Getdays@_Locinfo@std@@QBEPBGXZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z _Mbrtowc ?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ ?_Getdays@_Locinfo@std@@QBEPBDXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ |
VCRUNTIME140.dll |
__std_type_info_destroy_list
_except_handler4_common __vcrt_InitializeCriticalSectionEx strchr __std_exception_copy memcmp memchr __std_exception_destroy _purecall memmove _CxxThrowException __CxxFrameHandler3 memcpy memset strstr |
api-ms-win-crt-runtime-l1-1-0.dll |
_invalid_parameter_noinfo_noreturn
abort _initterm_e _initterm _wassert terminate _cexit _crt_at_quick_exit _errno _invalid_parameter_noinfo _execute_onexit_table _register_onexit_function _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _crt_atexit |
api-ms-win-crt-heap-l1-1-0.dll |
_callnewh
calloc free malloc |
api-ms-win-crt-utility-l1-1-0.dll |
qsort
rand |
api-ms-win-crt-math-l1-1-0.dll |
_libm_sse2_sqrt_precise
_dtest modf _libm_sse2_pow_precise _except1 _CIfmod _CIatan2 fmaxf _libm_sse2_atan_precise _libm_sse2_sin_precise _libm_sse2_cos_precise ceil _libm_sse2_tan_precise floor _libm_sse2_exp_precise |
api-ms-win-crt-stdio-l1-1-0.dll |
_get_stream_buffer_pointers
_getcwd __stdio_common_vsnprintf_s fputc setvbuf fwrite fgetc fsetpos _fseeki64 __stdio_common_vsscanf fgetpos __stdio_common_vfprintf ftell __acrt_iob_func fseek fread fflush fclose _wfopen ungetc freopen_s __stdio_common_vsprintf_s __stdio_common_vsprintf |
api-ms-win-crt-time-l1-1-0.dll |
clock
|
api-ms-win-crt-string-l1-1-0.dll |
toupper
isprint tolower strpbrk _strdup strncpy |
api-ms-win-crt-convert-l1-1-0.dll |
strtol
atoi |
api-ms-win-crt-locale-l1-1-0.dll |
localeconv
|
api-ms-win-crt-filesystem-l1-1-0.dll |
_unlock_file
remove _lock_file _stat64i32 |
Characteristics |
0
|
---|---|
TimeDateStamp | 2018-May-16 13:43:48 |
Version | 0.0 |
SizeofData | 91 |
AddressOfRawData | 0x2e374c |
PointerToRawData | 0x2e1f4c |
Referenced File | C:\Users\tgroben\Downloads\Castle-master\Castle\Release\Castle.pdb |
Characteristics |
0
|
---|---|
TimeDateStamp | 2018-May-16 13:43:48 |
Version | 0.0 |
SizeofData | 20 |
AddressOfRawData | 0x2e37a8 |
PointerToRawData | 0x2e1fa8 |
StartAddressOfRawData | 0x10306000 |
---|---|
EndAddressOfRawData | 0x10306208 |
AddressOfIndex | 0x10300ae0 |
AddressOfCallbacks | 0x10201da0 |
SizeOfZeroFill | 0 |
Characteristics |
IMAGE_SCN_ALIGN_4BYTES
|
Callbacks | (EMPTY) |
Size | 0xa0 |
---|---|
TimeDateStamp | 1970-Jan-01 00:00:00 |
Version | 0.0 |
GlobalFlagsClear | (EMPTY) |
GlobalFlagsSet | (EMPTY) |
CriticalSectionDefaultTimeout | 0 |
DeCommitFreeBlockThreshold | 0 |
DeCommitTotalFreeThreshold | 0 |
LockPrefixTable | 0 |
MaximumAllocationSize | 0 |
VirtualMemoryThreshold | 0 |
ProcessAffinityMask | 0 |
ProcessHeapFlags | (EMPTY) |
CSDVersion | 0 |
Reserved1 | 0 |
EditList | 0 |
SecurityCookie | 0x102f3aa0 |
SEHandlerTable | 0x102e2790 |
SEHandlerCount | 786 |
XOR Key | 0x7a5e8a7f |
---|---|
Unmarked objects | 0 |
Imports (VS2008 SP1 build 30729) | 20 |
199 (41118) | 1 |
ASM objects (VS2017 v15.?.? build 25930) | 10 |
C objects (VS2017 v15.?.? build 25930) | 11 |
C++ objects (VS2017 v15.?.? build 25930) | 23 |
Imports (VS2017 v15.?.? build 25930) | 4 |
Imports (24610) | 7 |
Total imports | 278 |
C++ objects (VS2017 v15.6.6 compiler 26131) | 72 |
Resource objects (VS2017 v15.6.6 compiler 26131) | 1 |
Linker (VS2017 v15.6.6 compiler 26131) | 1 |