.pe (parse PE file)
Description of the '.pe' command in HyperDbg.
Last updated
HyperDbg> .pe header "C:\reverse files\myfile.exe"
Valid Dos Exe File
------------------
Dumping DOS Header Info....
---------------------------
Magic number : MZ
Bytes on last page of file : 0x90
Pages in file : 0x3
Relocation : 0
Size of header in paragraphs : 0x4
Minimum extra paragraphs needed : 0
Maximum extra paragraphs needed : 0xffff
Initial (relative) SS value : 0
Initial SP value : 0xb8
Checksum : 0
Initial IP value : 0
Initial (relative) CS value : 0
File address of relocation table : 0x40
Overlay number : 0
OEM identifier : 0
OEM information(e_oemid specific) : 0
RVA address of PE header : 0x118
===============================================================================
===============================================================================
RICH HEADER
===============================================================================
Entries: 15
Build ID Prod ID Use Count
---------------------------------------
0x00008179 0x00000105 189
0x00008179 0x00000103 10
0x00008987 0x000000FD 3
0x00008987 0x00000104 19
0x00008987 0x00000103 12
0x00008987 0x00000105 111
0x00008179 0x00000104 34
0x00008179 0x00000106 1
0x00008179 0x00000101 39
0x00000000 0x00000001 633
0x00008995 0x00000109 305
0x00008995 0x00000100 1
0x00008995 0x000000FF 1
0x00000000 0x00000097 26
0x00008995 0x00000102 1
==============Rich Header End ==================
Valid PE64 file
-------------
Dumping COFF/PE Header Info....
--------------------------------
Signature : PE
Machine Architecture : AMD x64
Characteristics : Executable Image, Application can address > 2GB,
Time Stamp : Fri Mar 20 00:45:24 2026
No.sections(size) : 7
No.entries in symbol table : 0
Size of optional header : 240
Raw machine value : 0x8664
Pointer to symbol table : 0
Raw characteristics value : 0x22
Dumping PE Optional Header Info....
-----------------------------------
Info of optional Header
-----------------------
Address of Entry Point : 0x3e03a0
Raw optional header magic : 0x20b
Entrypoint file offset : 0x3df7a0
Base Address of the Image : 0x140000000
SubSystem type : Windows GUI
Given file is a : PE32+(64)
File Alignment : 0x200
Size of Image : 0x805000
Size of Headers : 0x400
Optional header checksum : 0x8032f2
Computed PE checksum : 0x8032f2 (matches)
Raw DLL characteristics value : 0x8160
DLL characteristics flags : High Entropy VA, Dynamic Base, NX Compatible, Terminal Server Aware
Size of code segment(.text) : 4405248
Base address of code segment(RVA) : 0x1000
Size of Initialized data : 3982336
Section Alignment : 0x1000
Major Linker Version : 14
Minor Linker Version : 44
Data directories
----------------
Number of RVA and sizes : 16
[ 0] Export Table RVA 0x53ec80, size 0x108, mapped file offset 0x53d880
[ 1] Import Table RVA 0x53ed88, size 0x190, mapped file offset 0x53d988
[ 2] Resource Table RVA 0x579000, size 0x284480, mapped file offset 0x571800
[ 3] Exception Table RVA 0x558000, size 0x1f1f4, mapped file offset 0x552400
[ 4] Certificate Table file offset 0x7fc200, size 0x2880, valid bounds, mapped file offset 0x7fc200
[ 5] Base Relocation Table RVA 0x7fe000, size 0x633c, mapped file offset 0x7f5e00
[ 6] Debug RVA 0x4e6740, size 0x1c, mapped file offset 0x4e5340
[ 7] Architecture RVA 0, size 0, empty
[ 8] Global Ptr RVA 0, size 0, empty
[ 9] TLS Table RVA 0x4e6900, size 0x28, mapped file offset 0x4e5500
[10] Load Config Table RVA 0x4e6600, size 0x140, mapped file offset 0x4e5200
[11] Bound Import RVA 0, size 0, empty
[12] Import Address Table RVA 0x435000, size 0x1328, mapped file offset 0x433c00
[13] Delay Import Descriptor RVA 0, size 0, empty
[14] CLR Runtime Header RVA 0, size 0, empty
[15] Reserved RVA 0, size 0, empty
Certificate table
-----------------
[0] file offset 0x7fc200 length 0x2880 revision 0x200 type 0x2
Certificate entry count : 1
Base relocations
----------------
[0] page RVA 0x436000 block size 0x18c entries 194
[1] page RVA 0x437000 block size 0x20 entries 12
...
Relocation block count : 97
Relocation entry count : 12314
Relocation type count : 0 = 42
Relocation type count : 10 = 12272
Info, printed relocation blocks : 0x20
Bound imports
-------------
Bound import directory : empty
Resources
---------
Resource directory count : 2496
Resource entry count : 4981
Resource declared data entries : 2486
Resource mapped data entries : 2486
Resource invalid entry count : 0
Resource named root types : 0
Resource declared data bytes : 0x265010
Resource mapped data bytes : 0x265010
Resource type count : cursor (1) = 1
Resource type count : bitmap (2) = 1
Resource type count : icon (3) = 1
Resource type count : menu (4) = 1
Resource type count : dialog (5) = 1
Resource type count : group cursor (12) = 1
Resource type count : group icon (14) = 1
Resource type count : version (16) = 1
Resource type count : manifest (24) = 1
Exceptions
----------
Runtime function count : 10623
[0] begin 0x1000 end 0x108d unwind 0x4f5450 version 1 flags 0x2 prolog 0x4 codes 1 frame reg 0 frame off 0
[1] begin 0x10a0 end 0x1127 unwind 0x4f5868 version 1 flags 0x2 prolog 0x4 codes 1 frame reg 0 frame off 0
[2] begin 0x1130 end 0x11b8 unwind 0x4f58b4 version 1 flags 0x2 prolog 0x4 codes 1 frame reg 0 frame off 0
...
Info, printed exception entries : 32
Delay imports
-------------
Delay import directory : empty
CLR runtime
-----------
CLR runtime header : empty
TLS
---
Start address of raw data VA : 0x1404f52f8
End address of raw data VA : 0x1404f5300
Address of index VA : 0x1405547fc
Address of callbacks VA : 0x140436558
Size of zero fill : 0
Characteristics : 0x300000
Debug
-----
[0] characteristics 0 time date stamp 0x69bc8a94 major 0 minor 0 type 13 size 0x42c address 0x4f4e80 raw 0x4f3a80
Payload bounds : valid
Load config
-----------
Size : 0x140
Time date stamp : 0
Major version : 0
Minor version : 0
Global flags clear : 0
Global flags set : 0
Critical section timeout : 0
Process heap flags : 0
Security cookie : 0x1405432c0
SE handler table : 0
SE handler count : 0
Guard CF check pointer : 0x140436328
Guard CF dispatch pointer : 0x140436338
Guard CF function table : 0
Guard CF function count : 0
Guard flags : 0x100
Guard flag names : CF instrumented
Guard address-taken IAT table : 0
Guard address-taken IAT count : 0
Guard long jump target table : 0
Guard long jump target count : 0
Dynamic value reloc table : 0
CHPE metadata pointer : 0
Guard RF failure routine : 0
Guard RF failure routine ptr : 0
Dynamic value reloc offset : 0
Dynamic value reloc section : 0
Guard RF verify stack ptr : 0
Hot patch table offset : 0
Enclave config pointer : 0
Volatile metadata pointer : 0x1404f447c
Guard EH continuation table : 0
Guard EH continuation count : 0
Guard XFG check pointer : 0x140436330
Guard XFG dispatch pointer : 0x140436340
Guard XFG table dispatch ptr : 0x140436348
CastGuard failure mode : 0x140436350
Guard memcpy pointer : 0x140436358
Imports
-------
[0] DLL name COMCTL32.dll
[0] hint 0x5a name ImageList_DragShowNolock thunk RVA 0x4350a8
[1] hint 0x66 name ImageList_GetImageInfo thunk RVA 0x4350b0
[2] hint 0x57 name ImageList_DragEnter thunk RVA 0x4350b8
[3] hint 0x59 name ImageList_DragMove thunk RVA 0x4350c0
...
[1] DLL name SHLWAPI.dll
[0] hint 0x59 name PathGetDriveNumberW thunk RVA 0x435a88
[1] hint 0x69 name PathIsRelativeW thunk RVA 0x435a90
[2] hint 0x3d name PathCombineW thunk RVA 0x435a98
...
[2] DLL name SHELL32.dll
[0] hint 0x2a name DragQueryFileW thunk RVA 0x435a20
[1] hint 0x26 name DragFinish thunk RVA 0x435a28
[2] hint 0x1af name ShellExecuteExW thunk RVA 0x435a30
...
[3] DLL name dbghelp.dll
[0] hint 0x16 name ImageNtHeader thunk RVA 0x436298
[4] DLL name VERSION.dll
[0] hint 0x7 name GetFileVersionInfoSizeW thunk RVA 0x436258
[1] hint 0x8 name GetFileVersionInfoW thunk RVA 0x436260
[2] hint 0x10 name VerQueryValueW thunk RVA 0x436268
[5] DLL name CRYPT32.dll
[0] hint 0xae name CryptMsgClose thunk RVA 0x435180
[1] hint 0x46 name CertGetCertificateContextProperty thunk RVA 0x435188
...
[6] DLL name WINTRUST.dll
[0] hint 0x92 name WinVerifyTrust thunk RVA 0x436288
[7] DLL name SensApi.dll
[0] hint 0x1 name IsDestinationReachableW thunk RVA 0x435b10
[1] hint 0x2 name IsNetworkAlive thunk RVA 0x435b18
[8] DLL name WININET.dll
[0] hint 0x9f name InternetCrackUrlW thunk RVA 0x436278
[9] DLL name UxTheme.dll
[0] hint 0x17 name EndBufferedAnimation thunk RVA 0x4361d8
[1] hint 0x51 name SetWindowTheme thunk RVA 0x4361e0
...
[10] DLL name dwmapi.dll
[0] hint 0xa name DwmGetColorizationColor thunk RVA 0x4362a8
[1] hint 0x1b name DwmSetWindowAttribute thunk RVA 0x4362b0
[11] DLL name KERNEL32.dll
[0] hint 0x31a name GetSystemTimeAsFileTime thunk RVA 0x435418
[1] hint 0x24c name GetDateFormatW thunk RVA 0x435420
...
[12] DLL name USER32.dll
[0] hint 0x29c name MonitorFromRect thunk RVA 0x435b28
[1] hint 0x6c name CreateDialogParamW thunk RVA 0x435b30
...
[17] DLL name OLEAUT32.dll
[0] ordinal 6 thunk RVA 0x435a08
[1] ordinal 4 thunk RVA 0x435a10
[18] DLL name IMM32.dll
[0] hint 0x72 name ImmSetCandidateWindow thunk RVA 0x4353c8
[1] hint 0x76 name ImmSetCompositionStringW thunk RVA 0x4353d0
...
Exports
-------
DLL name : notepad++.exe
Ordinal base : 1
Address table count : 8
Name pointer count : 8
[0] ordinal 1 name CreateLexer RVA 0x2cdde0
[1] ordinal 2 name GetLexerCount RVA 0x2cdd10
[2] ordinal 3 name GetLexerFactory RVA 0x2cddb0
[3] ordinal 4 name GetLexerName RVA 0x2cdd30
[4] ordinal 5 name GetLibraryPropertyNames RVA 0x2ce020
[5] ordinal 6 name GetNameSpace RVA 0x2ce030
[6] ordinal 7 name LexerNameFromID RVA 0x2cdfd0
[7] ordinal 8 name SetLibraryProperty RVA 0x3440
Dumping Sections Header Info....
--------------------------------
Section Info (1 of 7)
---------------------
Section Header name : .text
ActualSize of code or data : 0x4336cc
Virtual Address(RVA) : 0x1000
Size of raw data (rounded to FA) : 0x433800
Pointer to Raw Data : 0x400
Raw data bounds : valid
Raw data entropy : 6.4635
Raw data FNV-1a64 : 0xc8423699a1bf52d4
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains executable code, Readable,
Section Info (2 of 7)
---------------------
Section Header name : .rdata
ActualSize of code or data : 0x10dcb8
Virtual Address(RVA) : 0x435000
Size of raw data (rounded to FA) : 0x10de00
Pointer to Raw Data : 0x433c00
Raw data bounds : valid
Raw data entropy : 5.6967
Raw data FNV-1a64 : 0xc85a9aedccb357bf
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Section Info (3 of 7)
---------------------
Section Header name : .data
ActualSize of code or data : 0x146fc
Virtual Address(RVA) : 0x543000
Size of raw data (rounded to FA) : 0x10a00
Pointer to Raw Data : 0x541a00
Raw data bounds : valid
Raw data entropy : 3.8285
Raw data FNV-1a64 : 0xa31da6a0167f3806
Warning : virtual size is larger than raw data
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writable,
Section Info (4 of 7)
---------------------
Section Header name : .pdata
ActualSize of code or data : 0x1f1f4
Virtual Address(RVA) : 0x558000
Size of raw data (rounded to FA) : 0x1f200
Pointer to Raw Data : 0x552400
Raw data bounds : valid
Raw data entropy : 6.3830
Raw data FNV-1a64 : 0x272cb405f81bf335
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Section Info (5 of 7)
---------------------
Section Header name : .fptable
ActualSize of code or data : 0x100
Virtual Address(RVA) : 0x578000
Size of raw data (rounded to FA) : 0x200
Pointer to Raw Data : 0x571600
Raw data bounds : valid
Raw data entropy : 0.0000
Raw data FNV-1a64 : 0x7da144b97d054b25
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writable,
Section Info (6 of 7)
---------------------
Section Header name : .rsrc
ActualSize of code or data : 0x284480
Virtual Address(RVA) : 0x579000
Size of raw data (rounded to FA) : 0x284600
Pointer to Raw Data : 0x571800
Raw data bounds : valid
Raw data entropy : 7.5338
Raw data FNV-1a64 : 0xfd8a5bdb97251d09
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Section Info (7 of 7)
---------------------
Section Header name : .reloc
ActualSize of code or data : 0x633c
Virtual Address(RVA) : 0x7fe000
Size of raw data (rounded to FA) : 0x6400
Pointer to Raw Data : 0x7f5e00
Raw data bounds : valid
Raw data entropy : 5.4602
Raw data FNV-1a64 : 0x83c79c484f898f36
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Overlay and warnings
--------------------
Overlay offset : 0x7fc200
Overlay size : 0x2880
Info : overlay includes certificate data; not necessarily suspicious
===============================================================================HyperDbg> .pe section .rdata "C:\reverse files\myfile.exe"
Valid Dos Exe File
------------------
Dumping DOS Header Info....
---------------------------
Magic number : MZ
Bytes on last page of file : 0x90
Pages in file : 0x3
Relocation : 0
Size of header in paragraphs : 0x4
Minimum extra paragraphs needed : 0
Maximum extra paragraphs needed : 0xffff
Initial (relative) SS value : 0
Initial SP value : 0xb8
Checksum : 0
Initial IP value : 0
Initial (relative) CS value : 0
File address of relocation table : 0x40
Overlay number : 0
OEM identifier : 0
OEM information(e_oemid specific) : 0
RVA address of PE header : 0x108
===============================================================================
===============================================================================
RICH HEADER
===============================================================================
Entries: 12
Build ID Prod ID Use Count
---------------------------------------
0x00008179 0x00000105 173
0x00008179 0x00000104 14
0x00008179 0x00000103 8
0x00008987 0x00000103 10
0x00008987 0x00000104 16
0x00008987 0x00000105 81
0x00008179 0x00000101 2
0x0000899B 0x00000101 3
0x00000000 0x00000001 108
0x0000899B 0x00000109 1
0x0000899B 0x000000FF 1
0x0000899B 0x00000102 1
==============Rich Header End ==================
Valid PE64 file
-------------
Dumping COFF/PE Header Info....
--------------------------------
Signature : PE
Machine Architecture : AMD x64
Characteristics : Executable Image, Application can address > 2GB,
Time Stamp : Tue Jun 2 17:50:10 2026
No.sections(size) : 7
No.entries in symbol table : 0
Size of optional header : 240
Raw machine value : 0x8664
Pointer to symbol table : 0
Raw characteristics value : 0x22
Dumping PE Optional Header Info....
-----------------------------------
Info of optional Header
-----------------------
Address of Entry Point : 0x9c40
Raw optional header magic : 0x20b
Entrypoint file offset : 0x9040
Base Address of the Image : 0x140000000
SubSystem type : Windows CLI
Given file is a : PE32+(64)
File Alignment : 0x200
Size of Image : 0x8f000
Size of Headers : 0x400
Optional header checksum : 0
Computed PE checksum : 0x906c6 (differs)
Raw DLL characteristics value : 0x8160
DLL characteristics flags : High Entropy VA, Dynamic Base, NX Compatible, Terminal Server Aware
Size of code segment(.text) : 398848
Base address of code segment(RVA) : 0x1000
Size of Initialized data : 167936
Section Alignment : 0x1000
Major Linker Version : 14
Minor Linker Version : 44
Data directories
----------------
Number of RVA and sizes : 16
[ 0] Export Table RVA 0, size 0, empty
[ 1] Import Table RVA 0x828ac, size 0x3c, mapped file offset 0x812ac
[ 2] Resource Table RVA 0x8d000, size 0x1e0, mapped file offset 0x88200
[ 3] Exception Table RVA 0x87000, size 0x4d34, mapped file offset 0x83200
[ 4] Certificate Table file offset 0, size 0, empty
[ 5] Base Relocation Table RVA 0x8e000, size 0x9f0, mapped file offset 0x88400
[ 6] Debug RVA 0x7eaf0, size 0x70, mapped file offset 0x7d4f0
[ 7] Architecture RVA 0, size 0, empty
[ 8] Global Ptr RVA 0, size 0, empty
[ 9] TLS Table RVA 0, size 0, empty
[10] Load Config Table RVA 0x7e9b0, size 0x140, mapped file offset 0x7d3b0
[11] Bound Import RVA 0, size 0, empty
[12] Import Address Table RVA 0x63000, size 0x308, mapped file offset 0x61a00
[13] Delay Import Descriptor RVA 0, size 0, empty
[14] CLR Runtime Header RVA 0, size 0, empty
[15] Reserved RVA 0, size 0, empty
Certificate table
-----------------
Certificate table : empty
Base relocations
----------------
[0] page RVA 0x63000 block size 0x1e4 entries 238
[1] page RVA 0x64000 block size 0x3c entries 26
[2] page RVA 0x67000 block size 0xfc entries 122
[3] page RVA 0x68000 block size 0x18 entries 8
...
Relocation block count : 18
Relocation entry count : 1200
Relocation type count : 0 = 9
Relocation type count : 10 = 1191
Bound imports
-------------
Bound import directory : empty
Resources
---------
Resource directory count : 3
Resource entry count : 3
Resource declared data entries : 1
Resource mapped data entries : 1
Resource invalid entry count : 0
Resource named root types : 0
Resource declared data bytes : 0x17d
Resource mapped data bytes : 0x17d
Resource type count : manifest (24) = 1
Exceptions
----------
Runtime function count : 1647
[0] begin 0x1000 end 0x1022 unwind 0x801f0 version 1 flags 0 prolog 0x4 codes 1 frame reg 0 frame off 0
[1] begin 0x1030 end 0x1048 unwind 0x801f0 version 1 flags 0 prolog 0x4 codes 1 frame reg 0 frame off 0
[2] begin 0x1050 end 0x1068 unwind 0x801f0 version 1 flags 0 prolog 0x4 codes 1 frame reg 0 frame off 0
[3] begin 0x1070 end 0x1088 unwind 0x801f0 version 1 flags 0 prolog 0x4 codes 1 frame reg 0 frame off 0
...
Info, printed exception entries : 32
Delay imports
-------------
Delay import directory : empty
CLR runtime
-----------
CLR runtime header : empty
TLS
---
TLS directory : empty
Debug
-----
[0] characteristics 0 time date stamp 0x6a1efbb2 major 0 minor 0 type 2 size 0x6c address 0x7fd54 raw 0x7e754
Payload bounds : valid
CodeView RSDS GUID : fa280af0-3b09-4abd-9808-f1374a252ad7
CodeView age : 4
CodeView PDB path : C:\Users\sina\Desktop\HyperDbg\HyperDbg\hyperdbg\build\bin\release\hyperdbg-cli.pdb
[1] characteristics 0 time date stamp 0x6a1efbb2 major 0 minor 0 type 12 size 0x14 address 0x7fdc0 raw 0x7e7c0
Payload bounds : valid
[2] characteristics 0 time date stamp 0x6a1efbb2 major 0 minor 0 type 13 size 0x398 address 0x7fdd4 raw 0x7e7d4
Payload bounds : valid
[3] characteristics 0 time date stamp 0x6a1efbb2 major 0 minor 0 type 14 size 0 address 0 raw 0
Load config
-----------
Size : 0x140
Time date stamp : 0
Major version : 0
Minor version : 0
Global flags clear : 0
Global flags set : 0
Critical section timeout : 0
Process heap flags : 0
Security cookie : 0x140084040
SE handler table : 0
SE handler count : 0
Guard CF check pointer : 0x140063308
Guard CF dispatch pointer : 0x140063318
Guard CF function table : 0
Guard CF function count : 0
Guard flags : 0x100
Guard flag names : CF instrumented
Guard address-taken IAT table : 0
Guard address-taken IAT count : 0
Guard long jump target table : 0
Guard long jump target count : 0
Dynamic value reloc table : 0
CHPE metadata pointer : 0
Guard RF failure routine : 0
Guard RF failure routine ptr : 0
Dynamic value reloc offset : 0
Dynamic value reloc section : 0
Guard RF verify stack ptr : 0
Hot patch table offset : 0
Enclave config pointer : 0
Volatile metadata pointer : 0x14007fc34
Guard EH continuation table : 0
Guard EH continuation count : 0
Guard XFG check pointer : 0x140063310
Guard XFG dispatch pointer : 0x140063320
Guard XFG table dispatch ptr : 0x140063328
CastGuard failure mode : 0x140063330
Guard memcpy pointer : 0x140063338
Imports
-------
[0] DLL name libhyperdbg.dll
[0] hint 0xb name hyperdbg_u_continue_previous_command thunk RVA 0x632d8
[1] hint 0x4 name hyperdbg_u_check_multiline_command thunk RVA 0x632e0
[2] hint 0x2b name hyperdbg_u_show_signature thunk RVA 0x632e8
[3] hint 0x21 name hyperdbg_u_run_command thunk RVA 0x632f0
[4] hint 0x23 name hyperdbg_u_script_read_file_and_execute_commandline thunk RVA 0x632f8
[1] DLL name KERNEL32.dll
[0] hint 0x2a4 name GetModuleHandleExW thunk RVA 0x63000
[1] hint 0xe6 name CreateFileW thunk RVA 0x63008
[2] hint 0x593 name SetStdHandle thunk RVA 0x63010
[3] hint 0x55a name SetEnvironmentVariableW thunk RVA 0x63018
[4] hint 0x1d3 name FreeEnvironmentStringsW thunk RVA 0x63020
...
Exports
-------
Export directory : empty
Dumping Sections Header Info....
--------------------------------
Section Info (1 of 7)
---------------------
Section Header name : .text
ActualSize of code or data : 0x61576
Virtual Address(RVA) : 0x1000
Size of raw data (rounded to FA) : 0x61600
Pointer to Raw Data : 0x400
Raw data bounds : valid
Raw data entropy : 5.7032
Raw data FNV-1a64 : 0x52e943d1c070be2b
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains executable code, Readable,
Section Info (2 of 7)
---------------------
Section Header name : .rdata
ActualSize of code or data : 0x20346
Virtual Address(RVA) : 0x63000
Size of raw data (rounded to FA) : 0x20400
Pointer to Raw Data : 0x61a00
Raw data bounds : valid
Raw data entropy : 4.6294
Raw data FNV-1a64 : 0x713d846dd8017611
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
140063000: |24 30 08 00 | 00 00 00 00 | 2c 33 08 00 | 00 00 00 00 $0......,3......
140063010: | 1c 33 08 00 | 00 00 00 00 | 02 33 08 00 | 00 00 00 00 .3.......3......
...
140063050: | 0e 2d 08 00 | 00 00 00 00 | 2c 2d 08 00 | 00 00 00 00 .-......,-......
140063060: | 44 2d 08 00 | 00 00 00 00 | 54 2d 08 00 | 00 00 00 00 D-......T-......
140063070: | 64 2d 08 00 | 00 00 00 00 | 7a 2d 08 00 | 00 00 00 00 d-......z-......
...
1400630b0: | 00 2e 08 00 | 00 00 00 00 | 1c 2e 08 00 | 00 00 00 00 ................
1400630c0: | 3a 2e 08 00 | 00 00 00 00 | 4e 2e 08 00 | 00 00 00 00 :.......N.......
1400630d0: | 62 2e 08 00 | 00 00 00 00 | 7e 2e 08 00 | 00 00 00 00 b.......~.......
...
1400832f0: | 76 69 72 6f | 6e 6d 65 6e | 74 53 74 72 | 69 6e 67 73 vironmentStrings
140083300: | 57 00 5a 05 | 53 65 74 45 | 6e 76 69 72 | 6f 6e 6d 65 W.Z.SetEnvironme
...
140083330: | 65 61 74 65 | 46 69 6c 65 | 57 00 16 05 | 52 74 6c 55 eateFileW...RtlU
140083340: | 6e 77 69 6e | 64 00 00 00 | 00 00 00 00 | 00 00 00 00 nwind...........
140083350: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
140083360: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
140083370: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
140083380: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
140083390: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
1400833a0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
1400833b0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
1400833c0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
1400833d0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
1400833e0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
1400833f0: | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 ................
Section Info (3 of 7)
---------------------
Section Header name : .data
ActualSize of code or data : 0x2fd0
Virtual Address(RVA) : 0x84000
Size of raw data (rounded to FA) : 0x1400
Pointer to Raw Data : 0x81e00
Raw data bounds : valid
Raw data entropy : 2.6692
Raw data FNV-1a64 : 0x4add5d1c4b513b48
Warning : virtual size is larger than raw data
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writable,
Section Info (4 of 7)
---------------------
Section Header name : .pdata
ActualSize of code or data : 0x4d34
Virtual Address(RVA) : 0x87000
Size of raw data (rounded to FA) : 0x4e00
Pointer to Raw Data : 0x83200
Raw data bounds : valid
Raw data entropy : 5.3377
Raw data FNV-1a64 : 0x35dd9b50c5bce8c9
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Section Info (5 of 7)
---------------------
Section Header name : .fptable
ActualSize of code or data : 0x100
Virtual Address(RVA) : 0x8c000
Size of raw data (rounded to FA) : 0x200
Pointer to Raw Data : 0x88000
Raw data bounds : valid
Raw data entropy : 0.0000
Raw data FNV-1a64 : 0x7da144b97d054b25
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writable,
Section Info (6 of 7)
---------------------
Section Header name : .rsrc
ActualSize of code or data : 0x1e0
Virtual Address(RVA) : 0x8d000
Size of raw data (rounded to FA) : 0x200
Pointer to Raw Data : 0x88200
Raw data bounds : valid
Raw data entropy : 4.7177
Raw data FNV-1a64 : 0xb721756e709199f1
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Section Info (7 of 7)
---------------------
Section Header name : .reloc
ActualSize of code or data : 0x9f0
Virtual Address(RVA) : 0x8e000
Size of raw data (rounded to FA) : 0xa00
Pointer to Raw Data : 0x88400
Raw data bounds : valid
Raw data entropy : 5.4259
Raw data FNV-1a64 : 0xa5557b54c7f04571
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Overlay and warnings
--------------------
Overlay : none
===============================================================================