anno1404_1.3.exe - InstallShield Setup.exe - InstallScript Setup Launcher

info
MZ
PE
resources
strings
imports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	anno1404_1.3.exe
size	112342880 (0x6b23760)
md5	15aaee51bf03f93e0a6c86fe581e70a7

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
12	7291	3
14	7299	29
11	8047	3
10	9782	137
147	30729	2
28	9178	4
37	8755	2
1	0	377
25	9210	21
11	9782	55
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4cab8cfa
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x64e00
SizeOfInitializedData	0xb5400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x3d90d
BaseOfCode	0x1000
BaseOfData	0x66000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x11e000
SizeOfHeaders	0x400
CheckSum	0x6b288d5
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x64de3	0x64e00	R-X CODE
.rdata	0x66000	0xe246	0xe400	R-- IDATA
.data	0x75000	0x9f64	0x8400	RW- IDATA
.rsrc	0x7f000	0x9ea60	0x9ec00	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x724a0	0x104
RESOURCE	0x7f000	0x9ea60
EXCEPTION	0	0
SECURITY	0x6b221f0	0x1570
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x66000	0x588
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
GIF	IDR_GIF1	26002	1252
BITMAP	#103	82464	1252
BITMAP	#10550	7004	1252
BITMAP	#10551	14564	1252
BITMAP	#10553	4664	1252
BITMAP	#10650	25992	1252
BITMAP	#10651	73608	1252
ICON	#1	270376	1252
ICON	#2	67624	1252
ICON	#3	16936	1252
ICON	#4	9640	1252
ICON	#5	4264	1252
ICON	#6	2440	1252
ICON	#7	1128	1252
ICON	#8	4264	1252
ICON	#9	1128	1252
ICON	#10	744	1252
ICON	#11	744	1252
DIALOG	#103	510	1252
DIALOG	#105	662	1252
DIALOG	#106	736	1252
DIALOG	#107	100	1252
DIALOG	#108	66	1252
DIALOG	#109	230	1252
DIALOG	#119	292	1252
DIALOG	#121	230	1252
DIALOG	#125	630	1252
DIALOG	#126	984	1252
DIALOG	#127	386	1252
DIALOG	#128	540	1252
DIALOG	#129	506	1252
DIALOG	#130	546	1252
DIALOG	#131	140	1252
DIALOG	#132	972	1252
DIALOG	#1000	344	1252
DIALOG	#1001	490	1252
DIALOG	#1008	278	1252
DIALOG	#1026	238	1252
DIALOG	#1034	468	1252
DIALOG	#3003	492	1252
DIALOG	#3004	696	1252
STRING	#69	352	1252
STRING	#70	574	1252
STRING	#71	888	1252
STRING	#72	594	1252
STRING	#73	500	1252
STRING	#76	1644	1252
STRING	#101	870	1252
STRING	#102	638	1252
STRING	#103	1304	1252
STRING	#104	2178	1252
STRING	#105	574	1252
STRING	#107	954	1252
STRING	#108	300	1252
STRING	#113	74	1252
STRING	#114	218	1252
STRING	#115	272	1252
STRING	#116	522	1252
STRING	#117	186	1252
STRING	#118	168	1252
STRING	#119	298	1252
STRING	#120	1058	1252
STRING	#126	1474	1252
STRING	#134	64	1252
STRING	#135	3242	1252
STRING	#138	644	1252
GROUP_ICON	#100	104	1252
GROUP_ICON	#112	20	1252
GROUP_ICON	#217	20	1252
VERSION	#1	1124	1252
MANIFEST	#1	1143	1252

id	lang	string
1100	1033	Setup Initialization Error
1101	1033	%s
1102	1033	%1 Setup is preparing the %2, which will guide you through the program setup process. Please wait.
1103	1033	Checking Operating System Version
1104	1033	Checking Windows(R) Installer Version
1105	1033	Configuring Windows Installer
1106	1033	Configuring %s
1107	1033	Setup has completed configuring the Windows Installer on your system. The system needs to be restarted in order to continue with the installation. Please click Restart to reboot the system.
1108	1033	%s
1125	1033	Choose Setup Language
1126	1033	Select the language for this installation from the choices below.
1127	1033	The installer must restart your system to complete configuring the Windows Installer service. Click Yes to restart now or No if you plan to restart later.
1128	1033	This setup will perform an upgrade of '%s'. Do you want to continue?
1129	1033	A later version of '%s' is already installed on this machine. The setup cannot continue.
1130	1033	OK
1131	1033	Cancel
1132	1033	Password:
1133	1033	Install
1134	1033	&Next >
1150	1033	Setup has detected an incompatible version of Windows. Please click OK and verify that the target system is running either Windows 95 (or later version), or Windows NT 4.0 Service Pack 6 (or later version), before relaunching the installation
1151	1033	Error writing to the temporary location
1152	1033	Error extracting %s to the temporary location
1153	1033	Error reading setup initialization file
1154	1033	Installer not found in %s
1155	1033	File %s not found
1156	1033	Internal error in Windows Installer
1158	1033	Error populating strings. Verify that all strings in Setup.ini are valid.
1200	1033	Restart
1201	1033	Setup needs %lu KB free disk space in %s. Please free up some space and try again
1202	1033	You do not have sufficient privileges to complete this installation for all users of the machine. Log on as administrator and then retry this installation
1203	1033	Command line parameters:
1204	1033	/L language ID
1205	1033	/S Hide intialization dialog. For silent mode use: /S /v/qn.
1206	1033	/V parameters to MsiExec.exe
1207	1033	Windows(R) Installer %s found. This is an older version of the Windows(R) Installer. Click OK to continue.
1208	1033	ANSI code page for %s is not installed on the system and therefore setup cannot run in the selected language. Run the setup and select another language.
1210	1033	Setup requires Windows Installer version %s or higher to install the Microsoft .NET Framework version 2.0. Please install the Windows Installer version %s or higher and try again.
1604	1033	This setup does not contain the Windows Installer engine (%s) required to run the installation on this operating system.
1607	1033	Unable to install %s Scripting Runtime.
1608	1033	Unable to create InstallDriver instance, Return code: %d
1609	1033	Please specify a location to save the installation package.
1611	1033	Unable to extract the file %s.
1612	1033	Extracting files.
1613	1033	Downloading file %s.
1614	1033	An error occurred while downloading the file %s. What would you like to do?
1615	1033	hr
1616	1033	min
1617	1033	sec
1618	1033	MB
1619	1033	KB
1620	1033	/sec
1621	1033	Failed to verify signature of file %s.
1622	1033	Estimated time remaining:
1623	1033	%d %s of %d %s downloaded at %01d.%01d %s%s
1624	1033	Preparing to Install...
1625	1033	Get help for this installation.
1626	1033	Help
1627	1033	Unable to save file: %s
1628	1033	Failed to complete installation.
1629	1033	Invalid command line.
1630	1033	/UA<url to InstMsiA.exe>
1631	1033	/UW<url to InstMsiW.exe>
1632	1033	/UM<url to msi package>
1633	1033	/US<url to IsScript.msi>
1634	1033	Setup Initialization Error, failed to clone the process.
1635	1033	The file %s already exists. Would you like to replace it?
1642	1033	Could not verify signature. You need Internet Explorer 3.02 or later with Authenticode update.
1643	1033	Setup requires a newer version of WinInet.dll. You may need to install Internet Explorer 3.02 or later.
1644	1033	You do not have sufficient privileges to complete this installation. Log on as administrator and then retry this installation
1645	1033	Error installing Microsoft(R) .NET Framework, Return Code: %d
1646	1033	%s optionally uses the Microsoft (R) .NET %s Framework. Would you like to install it now?
1648	1033	Setup has detected an incompatible version of Windows. Please click OK and verify that the target system is running either Windows 95 (or later version), or Windows NT 4.0 Service Pack 3 (or later version), before relaunching the installation
1649	1033	%s optionally uses the Visual J# Redistributable Package. Would you like to install it now?
1650	1033	(This will also install the .NET Framework.)
1651	1033	Setup has detected an incompatible version of Windows. Please click OK and verify that the target system is running Windows 2000 Service Pack 3 (or later version), before relaunching the installation
1652	1033	%s requires the following items to be installed on your computer. Click Install to begin installing these requirements.
1653	1033	Installing %s
1654	1033	Would you like to cancel the setup after %s has finished installing?
1655	1033	The files for installation requirement %s could not be found. The installation will now stop. This is probably due to a failed, or canceled download.
1656	1033	The installation of %s appears to have failed. Do you want to continue the installation?
1657	1033	Succeeded
1658	1033	Installing
1659	1033	Pending
1660	1033	Installed
1661	1033	Status
1662	1033	Requirement
1663	1033	Failed
1664	1033	Extracting
1665	1033	Downloading
1666	1033	Skipped
1667	1033	The installation of %s has failed. Setup will now exit.
1668	1033	The installation of %s requires a reboot. Click Yes to restart now or No if you plan to restart later.
1669	1033	%1 optionally uses %2. Would you like to install it now?
1671	1033	Downloading file %2 of %3: %1
1702	1033	This installation lets you install multiple instances of the product. Select the instance you would like to install, and then click Next to continue:
1703	1033	&Install a new instance
1704	1033	&Maintain or upgrade an existing instance
1705	1033	Default
1706	1033	Instance ID
1707	1033	Product Name
1708	1033	Location
1710	1033	This installation lets you patch multiple instances of the product. Select an option below to specify how you would like to apply this patch, and then click Next to continue.
1711	1033	Patch &all of the existing instances
1712	1033	&Patch an existing instance
1713	1033	This installation requires Windows Installer version 4.5 or newer. Setup will now exit.
1714	1033	Decompressing
1715	1033	Version
1804	1033	Choose Setup Language
1812	1033	Select the language for the installation from the choices below.
1813	1033	&OK
1815	1033	InstallShield Wizard
1822	1033	Cancel
1834	1033	&Next >
1835	1033	< &Back
1837	1033	Do you wish to install %s?
1838	1033	Authenticity Verified
1839	1033	The identity of this software publisher was verified by %s.
1840	1033	Caution: %s affirms this software is safe. You should only continue if you trust %s to make this assertion.
1841	1033	&Always trust software published by %s.
1842	1033	This software has not been altered since publication by %s. To install %s, click OK.
1854	1033	InstallShield
1865	1033	Preparing Setup
1866	1033	Please wait while the InstallShield Wizard prepares the setup.
1872	1033	Finish
1873	1033	Transfer rate:
1874	1033	Estimated time left:
1880	1033	/s
1887	1033	%s - InstallShield Wizard
1888	1033	Exit Setup
1889	1033	Are you sure you want to cancel the setup?
1901	1033	&Install a new instance of this application.
1903	1033	Existing Installed Instances Detected
1904	1033	Select the appropriate application instance to maintain or update.
1905	1033	Setup has detected one or more instances of this application already installed on your system.
1906	1033	&Maintain or update the instance of this application selected below:
1907	1033	Setup has detected one or more instances of this application already installed on your system. You can maintain or update an existing instance or install a completely new instance.
1908	1033	Select the instance of the application you want to &maintain or update below:
1909	1033	Display Name
1910	1033	Install Location
2001	1033	%s Setup is preparing the InstallShield Wizard, which will guide you through the rest of the setup process. Please wait.
2002	1033	Error Code:
2003	1033	Error Information:
2004	1033	An error (%s) has occurred while running the setup.
2005	1033	Please make sure you have finished any previous setup and closed other applications. If the error still occurs, please contact your vendor: %s.
2006	1033	&Detail
2007	1033	&Report
2008	1033	There is not enough space to initialize the setup. Please free up at least %ld KB on your %s drive before you run the setup.
2009	1033	A user with administrator rights installed this application. You need to have similar privileges to modify or uninstall it.
2010	1033	Another instance of this setup is already running. Please wait for the other instance to finish and then try again.
2143	1033	Security Warning
2144	1033	Do you want to run this setup?
2146	1033	The origin and integrity of this application could not be verified. You should continue only if you can identify the publisher as someone you trust and are certain this application hasn't been altered since publication.
2147	1033	I &do not trust this setup
2148	1033	I &understand the security risk and wish to continue
2151	1033	The origin and integrity of this application could not be verified because it was not signed by the publisher. You should continue only if you can identify the publisher as someone you trust and are certain this application hasn't been altered since publication.
2152	1033	The origin and integrity of this application could not be verified. The certificate used to sign the software has expired or is invalid or untrusted. You should continue only if you can identify the publisher as someone you trust and are certain this application hasn't been altered since publication.
2153	1033	The software is corrupted or has been altered since it was published. You should not continue this setup.
2154	1033	This setup was created with a BETA VERSION of %s
2155	1033	This Setup was created with an EVALUATION VERSION of %s
2156	1033	Please enter the password
2157	1033	This setup was created with an EVALUATION VERSION of %s, which does not support extraction of the internal MSI file. The full version of InstallShield supports this functionality. For more information, see InstallShield KB article Q200900.
2158	1033	This setup was created with an EVALUATION VERSION of %s. Evaluation setups work for only %s days after they were built. Please rebuild the setup to run it again. The setup will now exit.
2159	1033	This setup works until %s. The setup will now exit.
2194	1033	InstallShield Setup Player V17
2195	1033	The path to the installation contains unsupported characters. Try moving the installation to a location that does not have special characters, and then try relaunching it.
2196	1033	This setup requires administrative privileges that appear to be unavailable. Would you like to try again?

module_name	hint	ord	function_name
COMCTL32.dll		17
VERSION.dll	2		GetFileVersionInfoSizeW
VERSION.dll	3		GetFileVersionInfoW
VERSION.dll	13		VerQueryValueW
KERNEL32.dll	214		FindResourceExW
KERNEL32.dll	318		GetDriveTypeW
KERNEL32.dll	886		WriteFile
KERNEL32.dll	924		lstrcpynW
KERNEL32.dll	918		lstrcmpiW
KERNEL32.dll	331		GetFileAttributesW
KERNEL32.dll	193		FindClose
KERNEL32.dll	200		FindFirstFileW
KERNEL32.dll	837		UnmapViewOfFile
KERNEL32.dll	580		MapViewOfFile
KERNEL32.dll	424		GetSystemInfo
KERNEL32.dll	861		VirtualQuery
KERNEL32.dll	50		CompareStringA
KERNEL32.dll	529		IsBadReadPtr
KERNEL32.dll	76		CreateFileMappingW
KERNEL32.dll	69		CreateDirectoryW
KERNEL32.dll	51		CompareStringW
KERNEL32.dll	302		GetCurrentDirectoryW
KERNEL32.dll	175		ExpandEnvironmentStringsW
KERNEL32.dll	752		SetFileAttributesW
KERNEL32.dll	183		FileTimeToLocalFileTime
KERNEL32.dll	335		GetFileTime
KERNEL32.dll	501		HeapFree
KERNEL32.dll	495		HeapAlloc
KERNEL32.dll	395		GetProcessHeap
KERNEL32.dll	822		TlsAlloc
KERNEL32.dll	825		TlsSetValue
KERNEL32.dll	306		GetCurrentThreadId
KERNEL32.dll	393		GetProcAddress
KERNEL32.dll	362		GetModuleHandleW
KERNEL32.dll	384		GetPrivateProfileIntW
KERNEL32.dll	921		lstrcpyW
KERNEL32.dll	927		lstrlenW
KERNEL32.dll	809		Sleep
KERNEL32.dll	44		CloseHandle
KERNEL32.dll	95		CreateProcessW
KERNEL32.dll	672		RemoveDirectoryW
KERNEL32.dll	121		DeleteFileW
KERNEL32.dll	766		SetLastError
KERNEL32.dll	333		GetFileSize
KERNEL32.dll	753		SetFilePointer
KERNEL32.dll	71		CreateEventW
KERNEL32.dll	639		QueryPerformanceFrequency
KERNEL32.dll	428		GetSystemTimeAsFileTime
KERNEL32.dll	669		ReleaseMutex
KERNEL32.dll	451		GetUserDefaultLangID
KERNEL32.dll	420		GetSystemDefaultLangID
KERNEL32.dll	88		CreateMutexW
KERNEL32.dll	747		SetErrorMode
KERNEL32.dll	561		LoadLibraryW
KERNEL32.dll	912		lstrcatW
KERNEL32.dll	229		FreeLibrary
KERNEL32.dll	316		GetDiskFreeSpaceW
KERNEL32.dll	848		VerLanguageNameW
KERNEL32.dll	873		WideCharToMultiByte
KERNEL32.dll	656		ReadFile
KERNEL32.dll	446		GetTickCount
KERNEL32.dll	254		GetCommandLineW
KERNEL32.dll	172		ExitThread
KERNEL32.dll	101		CreateThread
KERNEL32.dll	307		GetDateFormatA
KERNEL32.dll	447		GetTimeFormatA
KERNEL32.dll	74		CreateFileA
KERNEL32.dll	231		FreeResource
KERNEL32.dll	911		lstrcatA
KERNEL32.dll	592		MulDiv
KERNEL32.dll	917		lstrcmpiA
KERNEL32.dll	383		GetPrivateProfileIntA
KERNEL32.dll	389		GetPrivateProfileStringA
KERNEL32.dll	386		GetPrivateProfileSectionNamesA
KERNEL32.dll	380		GetOEMCP
KERNEL32.dll	235		GetACP
KERNEL32.dll	219		FlushFileBuffers
KERNEL32.dll	780		SetStdHandle
KERNEL32.dll	558		LoadLibraryA
KERNEL32.dll	418		GetStringTypeW
KERNEL32.dll	415		GetStringTypeA
KERNEL32.dll	526		IsBadCodePtr
KERNEL32.dll	324		GetExitCodeProcess
KERNEL32.dll	350		GetLocaleInfoW
KERNEL32.dll	541		IsValidLocale
KERNEL32.dll	920		lstrcpyA
KERNEL32.dll	926		lstrlenA
KERNEL32.dll	467		GetWindowsDirectoryW
KERNEL32.dll	518		InterlockedDecrement
KERNEL32.dll	568		LocalFree
KERNEL32.dll	522		InterlockedIncrement
KERNEL32.dll	225		FormatMessageW
KERNEL32.dll	439		GetTempPathW
KERNEL32.dll	457		GetVersionExW
KERNEL32.dll	77		CreateFileW
KERNEL32.dll	478		GlobalFree
KERNEL32.dll	215		FindResourceW
KERNEL32.dll	563		LoadResource
KERNEL32.dll	808		SizeofResource
KERNEL32.dll	471		GlobalAlloc
KERNEL32.dll	577		LockResource
KERNEL32.dll	482		GlobalLock
KERNEL32.dll	489		GlobalUnlock
KERNEL32.dll	593		MultiByteToWideChar
KERNEL32.dll	358		GetModuleFileNameW
KERNEL32.dll	423		GetSystemDirectoryW
KERNEL32.dll	741		SetCurrentDirectoryW
KERNEL32.dll	869		WaitForSingleObject
KERNEL32.dll	171		ExitProcess
KERNEL32.dll	303		GetCurrentProcess
KERNEL32.dll	136		DuplicateHandle
KERNEL32.dll	440		GetThreadContext
KERNEL32.dll	860		VirtualProtectEx
KERNEL32.dll	895		WriteProcessMemory
KERNEL32.dll	220		FlushInstructionCache
KERNEL32.dll	788		SetThreadContext
KERNEL32.dll	684		ResumeThread
KERNEL32.dll	346		GetLastError
KERNEL32.dll	241		GetCPInfo
KERNEL32.dll	412		GetStartupInfoA
KERNEL32.dll	336		GetFileType
KERNEL32.dll	414		GetStdHandle
KERNEL32.dll	762		SetHandleCount
KERNEL32.dll	253		GetCommandLineA
KERNEL32.dll	319		GetEnvironmentStrings
KERNEL32.dll	321		GetEnvironmentStringsW
KERNEL32.dll	228		FreeEnvironmentStringsW
KERNEL32.dll	227		FreeEnvironmentStringsA
KERNEL32.dll	834		UnhandledExceptionFilter
KERNEL32.dll	413		GetStartupInfoW
KERNEL32.dll	359		GetModuleHandleA
KERNEL32.dll	505		HeapReAlloc
KERNEL32.dll	643		RaiseException
KERNEL32.dll	689		RtlUnwind
KERNEL32.dll	118		DeleteCriticalSection
KERNEL32.dll	519		InterlockedExchange
KERNEL32.dll	588		MoveFileExW
KERNEL32.dll	532		IsBadWritePtr
KERNEL32.dll	853		VirtualAlloc
KERNEL32.dll	856		VirtualFree
KERNEL32.dll	497		HeapCreate
KERNEL32.dll	499		HeapDestroy
KERNEL32.dll	456		GetVersionExA
KERNEL32.dll	322		GetEnvironmentVariableA
KERNEL32.dll	357		GetModuleFileNameA
KERNEL32.dll	797		SetUnhandledExceptionFilter
KERNEL32.dll	507		HeapSize
KERNEL32.dll	545		LCMapStringW
KERNEL32.dll	544		LCMapStringA
KERNEL32.dll	824		TlsGetValue
KERNEL32.dll	437		GetTempFileNameW
KERNEL32.dll	609		OpenProcess
KERNEL32.dll	49		CompareFileTime
KERNEL32.dll	400		GetProcessTimes
KERNEL32.dll	817		TerminateProcess
KERNEL32.dll	348		GetLocalTime
KERNEL32.dll	514		InitializeCriticalSection
KERNEL32.dll	304		GetCurrentProcessId
KERNEL32.dll	455		GetVersion
KERNEL32.dll	557		LeaveCriticalSection
KERNEL32.dll	139		EnterCriticalSection
KERNEL32.dll	305		GetCurrentThread
KERNEL32.dll	859		VirtualProtect
KERNEL32.dll	694		SearchPathW
KERNEL32.dll	681		ResetEvent
KERNEL32.dll	748		SetEvent
KERNEL32.dll	638		QueryPerformanceCounter
KERNEL32.dll	814		SystemTimeToFileTime
KERNEL32.dll	914		lstrcmpA
KERNEL32.dll	207		FindNextFileW
KERNEL32.dll	915		lstrcmpW
USER32.dll	55		CharUpperW
USER32.dll	719		WaitForInputIdle
USER32.dll	157		DialogBoxIndirectParamW
USER32.dll	483		MessageBoxW
USER32.dll	729		wsprintfW
USER32.dll	599		SetForegroundWindow
USER32.dll	641		SetWindowLongW
USER32.dll	647		SetWindowTextW
USER32.dll	576		SendMessageW
USER32.dll	273		GetDlgItem
USER32.dll	444		LoadIconW
USER32.dll	198		EndDialog
USER32.dll	489		MoveWindow
USER32.dll	579		SetActiveWindow
USER32.dll	466		MapDialogRect
USER32.dll	598		SetFocus
USER32.dll	13		BeginPaint
USER32.dll	457		LoadStringW
USER32.dll	226		FillRect
USER32.dll	200		EndPaint
USER32.dll	318		GetMessageW
USER32.dll	143		DefWindowProcW
USER32.dll	362		GetWindow
USER32.dll	666		SystemParametersInfoW
USER32.dll	349		GetSystemMetrics
USER32.dll	471		MapWindowPoints
USER32.dll	331		GetPropW
USER32.dll	194		EnableMenuItem
USER32.dll	619		SetPropW
USER32.dll	557		RemovePropW
USER32.dll	346		GetSysColor
USER32.dll	446		LoadImageW
USER32.dll	268		GetDC
USER32.dll	554		ReleaseDC
USER32.dll	86		CreateDialogParamW
USER32.dll	325		GetParent
USER32.dll	378		GetWindowTextW
USER32.dll	431		IsWindowVisible
USER32.dll	225		ExitWindowsEx
USER32.dll	536		RegisterClassExW
USER32.dll	403		InvalidateRect
USER32.dll	402		IntersectRect
USER32.dll	203		EnumChildWindows
USER32.dll	364		GetWindowDC
USER32.dll	276		GetDlgItemTextW
USER32.dll	372		GetWindowRect
USER32.dll	699		UpdateWindow
USER32.dll	182		DrawIcon
USER32.dll	97		CreateWindowExW
USER32.dll	728		wsprintfA
USER32.dll	253		GetClassNameW
USER32.dll	28		CallWindowProcW
USER32.dll	179		DrawFocusRect
USER32.dll	394		InflateRect
USER32.dll	191		DrawTextW
USER32.dll	74		CopyRect
USER32.dll	84		CreateDialogIndirectParamW
USER32.dll	270		GetDesktopWindow
USER32.dll	255		GetClientRect
USER32.dll	428		IsWindowEnabled
USER32.dll	229		FindWindowExW
USER32.dll	418		IsDialogMessageW
USER32.dll	510		PeekMessageW
USER32.dll	490		MsgWaitForMultipleObjects
USER32.dll	682		TranslateMessage
USER32.dll	162		DispatchMessageW
USER32.dll	196		EnableWindow
USER32.dll	658		ShowWindow
USER32.dll	567		SendDlgItemMessageW
USER32.dll	512		PostMessageW
USER32.dll	561		ScreenToClient
USER32.dll	643		SetWindowPos
USER32.dll	427		IsWindow
USER32.dll	153		DestroyWindow
USER32.dll	367		GetWindowLongW
USER32.dll	596		SetDlgItemTextW
GDI32.dll	532		SetBkMode
GDI32.dll	570		SetTextColor
GDI32.dll	589		TextOutW
GDI32.dll	510		RestoreDC
GDI32.dll	531		SetBkColor
GDI32.dll	80		CreateSolidBrush
GDI32.dll	592		UnrealizeObject
GDI32.dll	525		SelectPalette
GDI32.dll	497		RealizePalette
GDI32.dll	18		BitBlt
GDI32.dll	45		CreateCompatibleDC
GDI32.dll	524		SelectObject
GDI32.dll	361		GetDIBColorTable
GDI32.dll	425		GetSystemPaletteEntries
GDI32.dll	69		CreatePalette
GDI32.dll	140		DeleteDC
GDI32.dll	63		CreateHalftonePalette
GDI32.dll	363		GetDeviceCaps
GDI32.dll	590		TranslateCharsetInfo
GDI32.dll	407		GetObjectW
GDI32.dll	61		CreateFontIndirectW
GDI32.dll	143		DeleteObject
GDI32.dll	142		DeleteMetaFile
GDI32.dll	44		CreateCompatibleBitmap
GDI32.dll	47		CreateDCW
GDI32.dll	421		GetStockObject
GDI32.dll	437		GetTextExtentPoint32W
GDI32.dll	70		CreatePatternBrush
GDI32.dll	51		CreateDIBitmap
GDI32.dll	555		SetMetaFileBitsEx
GDI32.dll	566		SetStretchBltMode
GDI32.dll	522		SelectClipRgn
GDI32.dll	75		CreateRectRgn
GDI32.dll	559		SetPixel
GDI32.dll	475		PatBlt
GDI32.dll	480		PlayMetaFile
GDI32.dll	583		StretchBlt
GDI32.dll	39		CreateBitmap
GDI32.dll	572		SetViewportExtEx
GDI32.dll	573		SetViewportOrgEx
GDI32.dll	576		SetWindowExtEx
GDI32.dll	577		SetWindowOrgEx
GDI32.dll	553		SetMapMode
GDI32.dll	517		SaveDC
ADVAPI32.dll	461		RegCreateKeyExW
ADVAPI32.dll	481		RegOpenKeyExA
ADVAPI32.dll	491		RegQueryValueExA
ADVAPI32.dll	429		OpenThreadToken
ADVAPI32.dll	279		GetTokenInformation
ADVAPI32.dll	29		AllocateAndInitializeSid
ADVAPI32.dll	214		EqualSid
ADVAPI32.dll	223		FreeSid
ADVAPI32.dll	424		OpenProcessToken
ADVAPI32.dll	332		LookupPrivilegeValueW
ADVAPI32.dll	28		AdjustTokenPrivileges
ADVAPI32.dll	483		RegOpenKeyW
ADVAPI32.dll	471		RegEnumKeyW
ADVAPI32.dll	470		RegEnumKeyExW
ADVAPI32.dll	464		RegDeleteKeyW
ADVAPI32.dll	505		RegSetValueExW
ADVAPI32.dll	473		RegEnumValueW
ADVAPI32.dll	492		RegQueryValueExW
ADVAPI32.dll	466		RegDeleteValueW
ADVAPI32.dll	304		InitializeSecurityDescriptor
ADVAPI32.dll	560		SetSecurityDescriptorOwner
ADVAPI32.dll	559		SetSecurityDescriptorGroup
ADVAPI32.dll	558		SetSecurityDescriptorDacl
ADVAPI32.dll	482		RegOpenKeyExW
ADVAPI32.dll	456		RegCloseKey
SHELL32.dll	155		ShellExecuteExW
SHELL32.dll	101		SHGetMalloc
SHELL32.dll	107		SHGetPathFromIDListW
SHELL32.dll	109		SHGetSpecialFolderLocation
ole32.dll	57		CoInitialize
ole32.dll	101		CoUninitialize
ole32.dll	59		CoInitializeSecurity
OLEAUT32.dll		12
OLEAUT32.dll		9
OLEAUT32.dll		200
OLEAUT32.dll		7
OLEAUT32.dll		5
OLEAUT32.dll		2
OLEAUT32.dll		6
OLEAUT32.dll		4
LZ32.dll	10		LZOpenFileW
LZ32.dll	5		LZCopy
LZ32.dll	3		LZClose
msi.dll		88
msi.dll		137
msi.dll		141
msi.dll		169
msi.dll		8
RPCRT4.dll	485		UuidToStringW
RPCRT4.dll	467		RpcStringFreeW
RPCRT4.dll	476		UuidCreate

StringTable 040904B0

CompanyName	Ubisoft
FileDescription	InstallScript Setup Launcher
FileVersion	1.03.0000
InternalName	Setup
LegalCopyright	Copyright (C) 2010 Flexera Software, Inc. and/or InstallShield Co. Inc. All Rights Reserved.
OriginalFilename	InstallShield Setup.exe
ProductName	Anno 1404
ProductVersion	1.03.0000
Internal Build Number	99584
ISInternalVersion	17.0.717
ISInternalDescription	InstallScript Setup Launcher

VS_FIXEDFILEINFO

FileVersion	1.3.0.0
ProductVersion	1.3.0.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	4
FileType	2
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)09/CN=VeriSign Class 3 Code Signing 2009-2 CA

serial: 70A3DA9BEC194B1E5598FBEC79B84713

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: Jun 15 00:00:00 2007 GMT
            Not After : Jun 14 23:59:59 2012 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer - G2
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:c4:b5:f2:52:15:bc:88:86:60:29:16:4a:5b:2f:
                    4b:91:6b:87:91:f3:35:54:58:35:ea:d1:36:5e:62:
                    4d:52:51:34:71:c2:7b:66:1d:89:c8:dd:2a:c4:6a:
                    0a:f6:37:d9:98:74:91:f6:92:ae:b0:b5:76:96:f1:
                    a9:4a:63:45:47:2e:6b:0b:92:4e:4b:2b:8c:ee:58:
                    4a:8b:d4:07:e4:1a:2c:f8:82:aa:58:d9:cd:42:f3:
                    2d:c0:75:de:8d:ab:c7:8e:1d:9a:6c:4c:08:95:1e:
                    de:db:ef:67:e1:72:c2:49:c2:9e:60:3c:e1:e2:be:
                    16:a3:63:78:69:14:7b:ad:2d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl

            X509v3 Extended Key Usage: critical
                Time Stamping
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-2
    Signature Algorithm: sha1WithRSAEncryption
         50:c5:4b:c8:24:80:df:e4:0d:24:c2:de:1a:b1:a1:02:a1:a6:
         82:2d:0c:83:15:81:37:0a:82:0e:2c:b0:5a:17:61:b5:d8:05:
         fe:88:db:f1:91:91:b3:56:1a:40:a6:eb:92:be:38:39:b0:75:
         36:74:3a:98:4f:e4:37:ba:99:89:ca:95:42:1d:b0:b9:c7:a0:
         8d:57:e0:fa:d5:64:04:42:35:4e:01:d1:33:a2:17:c8:4d:aa:
         27:c7:f2:e1:86:4c:02:38:4d:83:78:c6:fc:53:e0:eb:e0:06:
         87:dd:a4:96:9e:5e:0c:98:e2:a5:be:bf:82:85:c3:60:e1:df:
         ad:28:d8:c7:a5:4b:64:da:c7:1b:5b:bd:ac:39:08:d5:38:22:
         a1:33:8b:2f:8a:9a:eb:bc:07:21:3f:44:41:09:07:b5:65:1c:
         24:bc:48:d3:44:80:eb:a1:cf:c9:02:b4:14:cf:54:c7:16:a3:
         80:5c:f9:79:3e:5d:72:7d:88:17:9e:2c:43:a2:ca:53:ce:7d:
         3d:f6:2a:3a:b8:4f:94:00:a5:6d:0a:83:5d:f9:5e:53:f4:18:
         b3:57:0f:70:c3:fb:f5:ad:95:a0:0e:17:de:c4:16:80:60:c9:
         0f:2b:6e:86:04:f1:eb:f4:78:27:d1:05:c5:ee:34:5b:5e:b9:
         49:32:f2:33

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl

            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
         4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
         d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
         04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
         15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
         fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
         e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
         c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
         3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
        Validity
            Not Before: May 21 00:00:00 2009 GMT
            Not After : May 20 23:59:59 2019 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009-2 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:be:67:1d:b4:60:aa:10:49:6f:56:17:7c:66:c9:
                    5e:86:0d:d5:f1:ac:a7:71:83:8e:8b:89:f8:88:04:
                    89:15:06:ba:2d:84:21:95:e4:d1:9c:50:4c:fb:d2:
                    22:bd:da:f2:b2:35:3b:1e:8f:c3:09:fb:fc:13:2e:
                    5a:bf:89:7c:3d:3b:25:1e:f6:f3:58:7b:9c:f4:01:
                    b5:c6:0a:b8:80:ce:be:27:74:61:67:27:4d:6a:e5:
                    ec:81:61:58:79:a3:e0:17:10:12:15:27:b0:e1:4d:
                    34:7f:2b:47:20:44:b9:de:66:24:66:8a:cd:4f:ba:
                    1f:c5:38:c8:54:90:e1:72:f6:19:66:75:6a:b9:49:
                    68:cf:38:79:0d:aa:30:a8:db:2c:60:48:9e:d7:aa:
                    14:01:a9:83:d7:38:91:30:39:13:96:03:3a:7c:40:
                    54:b6:ad:e0:2f:1b:83:dc:a8:11:52:3e:02:b3:d7:
                    2b:fd:21:b6:a7:5c:a3:0f:0b:a9:a6:10:50:0e:34:
                    2e:4d:a7:ce:c9:5e:25:d4:8c:bc:f3:6e:7c:29:bc:
                    01:5d:fc:31:87:5a:d5:8c:85:67:58:88:19:a0:bf:
                    35:f0:ea:2b:a3:21:e7:90:f6:83:e5:a8:ed:60:78:
                    5e:7b:60:83:fd:57:0b:5d:41:0d:63:54:60:d6:43:
                    21:ef
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/pca3.crl

            X509v3 Subject Alternative Name: 
                DirName:/CN=Class3CA2048-1-55
            X509v3 Subject Key Identifier: 
                97:D0:6B:A8:26:70:C8:A1:3F:94:1F:08:2D:C4:35:9B:A4:A1:1E:F2
    Signature Algorithm: sha1WithRSAEncryption
         8b:03:c0:dd:94:d8:41:a2:61:69:b0:15:a8:78:c7:30:c6:90:
         3c:7e:42:f7:24:b6:e4:83:73:17:04:7f:04:10:9c:a1:e2:fa:
         81:2f:eb:c0:ca:44:e7:72:e0:50:b6:55:10:20:83:6e:96:92:
         e4:9a:51:6a:b4:37:31:dc:a5:2d:eb:8c:00:c7:1d:4f:e7:4d:
         32:ba:85:f8:4e:be:fa:67:55:65:f0:6a:be:7a:ca:64:38:1a:
         10:10:78:45:76:31:f3:86:7a:03:0f:60:c2:b3:5d:9d:f6:8b:
         66:76:82:1b:59:e1:83:e5:bd:49:a5:38:56:e5:de:41:77:0e:
         58:0f

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            70:a3:da:9b:ec:19:4b:1e:55:98:fb:ec:79:b8:47:13
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class 3 Code Signing 2009-2 CA
        Validity
            Not Before: Jul 22 00:00:00 2009 GMT
            Not After : Sep  2 23:59:59 2012 GMT
        Subject: C=DE, ST=Rheinland-Pfalz, L=Mainz, O=Related Designs Software, OU=Digital ID Class 3 - Microsoft Software Validation v2, OU=Game Development, CN=Related Designs Software
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:b9:98:a1:ec:29:0d:3a:97:2c:ab:12:4e:bb:e8:
                    b9:f8:11:da:3f:72:cb:71:42:8a:84:12:b9:cd:c7:
                    a6:82:3d:e2:58:1c:81:f2:4e:16:68:55:68:e1:01:
                    2e:27:2a:f7:f8:13:7d:1c:c2:57:c8:63:d1:9d:fd:
                    9f:c6:e0:8c:8f:cf:59:3d:00:de:83:7d:16:8d:ed:
                    ba:17:5f:3c:3e:c4:04:5a:d2:ac:ab:a1:1b:de:70:
                    a7:44:c9:e9:cf:9e:c1:50:36:7e:53:23:31:d3:80:
                    3b:49:a2:38:a0:6a:18:5b:13:79:36:04:a6:10:86:
                    67:5b:a8:a6:0a:8b:e4:79:3d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer

            X509v3 Authority Key Identifier: 
                keyid:97:D0:6B:A8:26:70:C8:A1:3F:94:1F:08:2D:C4:35:9B:A4:A1:1E:F2

            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
         ad:9f:6f:ad:b3:75:d3:25:c2:a1:1e:da:3f:4d:78:9d:ed:41:
         68:04:35:21:db:d8:67:0d:20:fb:6b:d7:d8:26:49:14:ce:36:
         c5:19:66:50:ce:cd:99:a8:b3:eb:47:dd:88:b3:56:14:2d:2e:
         8c:88:22:ee:3c:e6:0b:f7:d1:7e:95:19:91:91:ad:3d:34:fd:
         c5:77:c0:c3:5f:ed:c4:19:92:e0:da:23:f1:96:e5:d0:1b:23:
         01:fe:71:43:29:75:67:3c:41:d5:de:a9:a4:34:ae:29:03:9a:
         57:c1:ca:6c:31:07:ff:63:67:bf:dc:36:69:5f:b4:c9:92:ca:
         f5:4b:04:7a:6b:53:a2:d1:34:72:ee:14:bd:c8:70:f0:cd:67:
         68:d5:2c:92:f7:ba:50:b8:4b:60:e8:c1:69:0c:8d:34:61:db:
         72:21:80:b8:01:c8:fa:ff:bd:ff:d8:42:69:bc:ae:39:1b:94:
         a9:41:20:9e:3e:d7:cb:ca:d4:1a:6b:95:51:c9:ee:27:78:18:
         f2:96:2f:14:22:bf:c3:4b:9d:a2:12:97:a3:f1:88:92:1f:99:
         3f:55:32:2c:6f:70:66:14:2a:79:8a:38:39:2d:8f:07:9e:80:
         42:39:f0:d8:86:96:93:3d:4e:bf:89:f2:fe:47:f3:f2:19:26:
         81:7d:e2:52

pkcs7-signedData

1
- SHA1: nil
- 1.3.6.1.4.1.311.2.1.4
  - #0
    - 1.3.6.1.4.1.311.2.1.15
      - :
        00 3c 00 3c 00 3c 00 4f 00 62 00 73 00 6f 00 6c |.<.<.<.O.b.s.o.l| 00 65 00 74 00 65 00 3e 00 3e 00 3e |.e.t.e.>.>.> |
    - SHA1
      - 07 7e 86 40 5f fc d9 f2 eb 44 b1 40 b7 4e 93 9d |.~.@_....D.@.N..| a2 d6 aa 76 |...v |
- Certificates
  - Certificate #0
    - 2
      - 38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - 2007-06-15 00:00:00 UTC: 2012-06-14 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services Signer - G2
      - #5
        rsaEncryption: nil
        C4:B5:F2:52:15:BC:88:86:60:29:16:4A:5B:2F:4B:91:
        6B:87:91:F3:35:54:58:35:EA:D1:36:5E:62:4D:52:51:
        34:71:C2:7B:66:1D:89:C8:DD:2A:C4:6A:0A:F6:37:D9:
        98:74:91:F6:92:AE:B0:B5:76:96:F1:A9:4A:63:45:47:
        2E:6B:0B:92:4E:4B:2B:8C:EE:58:4A:8B:D4:07:E4:1A:
        2C:F8:82:AA:58:D9:CD:42:F3:2D:C0:75:DE:8D:AB:C7:
        8E:1D:9A:6C:4C:08:95:1E:DE:DB:EF:67:E1:72:C2:49:
        C2:9E:60:3C:E1:E2:BE:16:A3:63:78:69:14:7B:AD:2D: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        nil
        crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
        extendedKeyUsage: true, timeStamping
        keyUsage: true, 0xc0
        subjectAltName
        CN: TSA1-2
    - RSA-SHA1:
```
50 c5 4b c8 24 80 df e4  0d 24 c2 de 1a b1 a1 02  |P.K.$....$......|
a1 a6 82 2d 0c 83 15 81  37 0a 82 0e 2c b0 5a 17  |...-....7...,.Z.|
61 b5 d8 05 fe 88 db f1  91 91 b3 56 1a 40 a6 eb  |a..........V.@..|
92 be 38 39 b0 75 36 74  3a 98 4f e4 37 ba 99 89  |..89.u6t:.O.7...|
ca 95 42 1d b0 b9 c7 a0  8d 57 e0 fa d5 64 04 42  |..B......W...d.B|
35 4e 01 d1 33 a2 17 c8  4d aa 27 c7 f2 e1 86 4c  |5N..3...M.'....L|
02 38 4d 83 78 c6 fc 53  e0 eb e0 06 87 dd a4 96  |.8M.x..S........|
9e 5e 0c 98 e2 a5 be bf  82 85 c3 60 e1 df ad 28  |.^.........`...(|
d8 c7 a5 4b 64 da c7 1b  5b bd ac 39 08 d5 38 22  |...Kd...[..9..8"|
a1 33 8b 2f 8a 9a eb bc  07 21 3f 44 41 09 07 b5  |.3./.....!?DA...|
65 1c 24 bc 48 d3 44 80  eb a1 cf c9 02 b4 14 cf  |e.$.H.D.........|
54 c7 16 a3 80 5c f9 79  3e 5d 72 7d 88 17 9e 2c  |T....\.y>]r}...,|
43 a2 ca 53 ce 7d 3d f6  2a 3a b8 4f 94 00 a5 6d  |C..S.}=.*:.O...m|
0a 83 5d f9 5e 53 f4 18  b3 57 0f 70 c3 fb f5 ad  |..].^S...W.p....|
95 a0 0e 17 de c4 16 80  60 c9 0f 2b 6e 86 04 f1  |........`..+n...|
eb f4 78 27 d1 05 c5 ee  34 5b 5e b9 49 32 f2 33  |..x'....4[^.I2.3|
```
  - Certificate #1
    - 2
      - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
      - RSA-SHA1: nil
      - Issuer
        C: ZA
        ST: Western Cape
        L: Durbanville
        O: Thawte
        OU: Thawte Certification
        CN: Thawte Timestamping CA
      - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
      - #5
        rsaEncryption: nil
        A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
        4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
        33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
        EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
        94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
        FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
        E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
        5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
        57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
        E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
        BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
        6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
        1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
        1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
        F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
        0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
      - X509v3 extensions
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        basicConstraints
        true
        true: 0
        crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
        extendedKeyUsage: timeStamping
        keyUsage: true, 6
        subjectAltName
        CN: TSA2048-1-53
    - RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
  - Certificate #2
    - 2
      - 65:52:26:E1:B2:2E:18:E1:59:0F:29:85:AC:22:E7:5C
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        OU: Class 3 Public Primary Certification Authority
      - 2009-05-21 00:00:00 UTC: 2019-05-20 23:59:59 UTC
      - Subject
        C: US
        O: VeriSign, Inc.
        OU: VeriSign Trust Network
        OU: Terms of use at https://www.verisign.com/rpa (c)09
        CN: VeriSign Class 3 Code Signing 2009-2 CA
      - #5
        rsaEncryption: nil
        BE:67:1D:B4:60:AA:10:49:6F:56:17:7C:66:C9:5E:86:
        0D:D5:F1:AC:A7:71:83:8E:8B:89:F8:88:04:89:15:06:
        BA:2D:84:21:95:E4:D1:9C:50:4C:FB:D2:22:BD:DA:F2:
        B2:35:3B:1E:8F:C3:09:FB:FC:13:2E:5A:BF:89:7C:3D:
        3B:25:1E:F6:F3:58:7B:9C:F4:01:B5:C6:0A:B8:80:CE:
        BE:27:74:61:67:27:4D:6A:E5:EC:81:61:58:79:A3:E0:
        17:10:12:15:27:B0:E1:4D:34:7F:2B:47:20:44:B9:DE:
        66:24:66:8A:CD:4F:BA:1F:C5:38:C8:54:90:E1:72:F6:
        19:66:75:6A:B9:49:68:CF:38:79:0D:AA:30:A8:DB:2C:
        60:48:9E:D7:AA:14:01:A9:83:D7:38:91:30:39:13:96:
        03:3A:7C:40:54:B6:AD:E0:2F:1B:83:DC:A8:11:52:3E:
        02:B3:D7:2B:FD:21:B6:A7:5C:A3:0F:0B:A9:A6:10:50:
        0E:34:2E:4D:A7:CE:C9:5E:25:D4:8C:BC:F3:6E:7C:29:
        BC:01:5D:FC:31:87:5A:D5:8C:85:67:58:88:19:A0:BF:
        35:F0:EA:2B:A3:21:E7:90:F6:83:E5:A8:ED:60:78:5E:
        7B:60:83:FD:57:0B:5D:41:0D:63:54:60:D6:43:21:EF: 0x010001
      - X509v3 extensions
        basicConstraints
        true
        true: 0
        certificatePolicies
        2.16.840.1.113733.1.7.23.3
        #0
        id-qt-cps: https://www.verisign.com/cps
        id-qt-unotice: https://www.verisign.com/rpa
        keyUsage: true, 6
        1.3.6.1.5.5.7.1.12
        image/gif
        SHA1:
        8f e5 d3 1a 86 ac 8d 8e 6b c3 cf 80 6a d4 48 18 |........k...j.H.| 2c 7b 19 2e |,{.. |
        http://logo.verisign.com/vslogo.gif
        extendedKeyUsage
        clientAuth: codeSigning
        authorityInfoAccess
        OCSP: http://ocsp.verisign.com
        crlDistributionPoints: http://crl.verisign.com/pca3.crl
        subjectAltName
        CN: Class3CA2048-1-55
        subjectKeyIdentifier:
        97 d0 6b a8 26 70 c8 a1 3f 94 1f 08 2d c4 35 9b |..k.&p..?...-.5.| a4 a1 1e f2 |.... |
    - RSA-SHA1:
```
8b 03 c0 dd 94 d8 41 a2  61 69 b0 15 a8 78 c7 30  |......A.ai...x.0|
c6 90 3c 7e 42 f7 24 b6  e4 83 73 17 04 7f 04 10  |..<~B.$...s.....|
9c a1 e2 fa 81 2f eb c0  ca 44 e7 72 e0 50 b6 55  |...../...D.r.P.U|
10 20 83 6e 96 92 e4 9a  51 6a b4 37 31 dc a5 2d  |. .n....Qj.71..-|
eb 8c 00 c7 1d 4f e7 4d  32 ba 85 f8 4e be fa 67  |.....O.M2...N..g|
55 65 f0 6a be 7a ca 64  38 1a 10 10 78 45 76 31  |Ue.j.z.d8...xEv1|
f3 86 7a 03 0f 60 c2 b3  5d 9d f6 8b 66 76 82 1b  |..z..`..]...fv..|
59 e1 83 e5 bd 49 a5 38  56 e5 de 41 77 0e 58 0f  |Y....I.8V..Aw.X.|
```
  - Certificate #3
    - 2
      - 70:A3:DA:9B:EC:19:4B:1E:55:98:FB:EC:79:B8:47:13
      - RSA-SHA1: nil
      - Issuer
        C: US
        O: VeriSign, Inc.
        OU: VeriSign Trust Network
        OU: Terms of use at https://www.verisign.com/rpa (c)09
        CN: VeriSign Class 3 Code Signing 2009-2 CA
      - 2009-07-22 00:00:00 UTC: 2012-09-02 23:59:59 UTC
      - Subject
        C: DE
        ST: Rheinland-Pfalz
        L: Mainz
        O: Related Designs Software
        OU: Digital ID Class 3 - Microsoft Software Validation v2
        OU: Game Development
        CN: Related Designs Software
      - #5
        rsaEncryption: nil
        B9:98:A1:EC:29:0D:3A:97:2C:AB:12:4E:BB:E8:B9:F8:
        11:DA:3F:72:CB:71:42:8A:84:12:B9:CD:C7:A6:82:3D:
        E2:58:1C:81:F2:4E:16:68:55:68:E1:01:2E:27:2A:F7:
        F8:13:7D:1C:C2:57:C8:63:D1:9D:FD:9F:C6:E0:8C:8F:
        CF:59:3D:00:DE:83:7D:16:8D:ED:BA:17:5F:3C:3E:C4:
        04:5A:D2:AC:AB:A1:1B:DE:70:A7:44:C9:E9:CF:9E:C1:
        50:36:7E:53:23:31:D3:80:3B:49:A2:38:A0:6A:18:5B:
        13:79:36:04:A6:10:86:67:5B:A8:A6:0A:8B:E4:79:3D: 0x010001
      - X509v3 extensions
        basicConstraints
        nil
        keyUsage: true, 0x80
        crlDistributionPoints: http://csc3-2009-2-crl.verisign.com/CSC3-2009-2.crl
        certificatePolicies
        2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
        extendedKeyUsage: codeSigning
        authorityInfoAccess
        #0
        OCSP: http://ocsp.verisign.com
        caIssuers: http://csc3-2009-2-aia.verisign.com/CSC3-2009-2.cer
        authorityKeyIdentifier:
        97 d0 6b a8 26 70 c8 a1 3f 94 1f 08 2d c4 35 9b |..k.&p..?...-.5.| a4 a1 1e f2 |.... |
        nsCertType: 0x10
        1.3.6.1.4.1.311.2.1.27
        false: true
    - RSA-SHA1:
```
ad 9f 6f ad b3 75 d3 25  c2 a1 1e da 3f 4d 78 9d  |..o..u.%....?Mx.|
ed 41 68 04 35 21 db d8  67 0d 20 fb 6b d7 d8 26  |.Ah.5!..g. .k..&|
49 14 ce 36 c5 19 66 50  ce cd 99 a8 b3 eb 47 dd  |I..6..fP......G.|
88 b3 56 14 2d 2e 8c 88  22 ee 3c e6 0b f7 d1 7e  |..V.-...".<....~|
95 19 91 91 ad 3d 34 fd  c5 77 c0 c3 5f ed c4 19  |.....=4..w.._...|
92 e0 da 23 f1 96 e5 d0  1b 23 01 fe 71 43 29 75  |...#.....#..qC)u|
67 3c 41 d5 de a9 a4 34  ae 29 03 9a 57 c1 ca 6c  |g.....k.|
51 c9 ee 27 78 18 f2 96  2f 14 22 bf c3 4b 9d a2  |Q..'x.../."..K..|
12 97 a3 f1 88 92 1f 99  3f 55 32 2c 6f 70 66 14  |........?U2,opf.|
2a 79 8a 38 39 2d 8f 07  9e 80 42 39 f0 d8 86 96  |*y.89-....B9....|
93 3d 4e bf 89 f2 fe 47  f3 f2 19 26 81 7d e2 52  |.=N....G...&.}.R|
```
- Signer
  - 1
  - unnamed
    - #0
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)09
      - CN: VeriSign Class 3 Code Signing 2009-2 CA
    - 70:A3:DA:9B:EC:19:4B:1E:55:98:FB:EC:79:B8:47:13
  - SHA1: nil
  - #3
    - 1.3.6.1.4.1.311.2.1.12
      - nil
    - contentType: 1.3.6.1.4.1.311.2.1.4
    - 1.3.6.1.4.1.311.2.1.11: msCodeInd
    - messageDigest:
```
10 40 2f 55 b3 95 68 d0  0d b1 49 a4 ac 02 c4 61  |.@/U..h...I....a|
03 b7 f5 e1                                       |....            |
```
  - rsaEncryption:
```
b5 f7 53 71 c4 77 27 86  7d 3c 80 5c 45 fa ec ec  |..Sq.w'.}<.\E...|
51 2a 0c fd 3d 38 5b d7  9d e6 01 67 5f 90 81 b8  |Q*..=8[....g_...|
5f 15 91 10 28 af 05 43  de 70 2d 34 4c 53 82 ff  |_...(..C.p-4LS..|
f6 e7 49 14 24 79 cc 15  d6 78 3c 5f 40 ea fc c9  |..I.$y...x<_@...|
11 70 af 93 2e f5 b2 87  38 02 3d 76 92 a3 94 46  |.p......8.=v...F|
73 ec 23 a9 ee af ae 55  ef 6b f5 5f 49 e4 52 77  |s.#....U.k._I.Rw|
63 61 21 17 f5 f7 6e 04  9c 2e 98 3e 8e ff 1d 09  |ca!...n....>....|
68 ff f3 f0 f4 b7 8d 88  c6 d2 50 73 cb db 44 46  |h.........Ps..DF|
```
  - countersignature
    - 1
      - unnamed
        #0
        C: US
        O: VeriSign, Inc.
        CN: VeriSign Time Stamping Services CA
        38:25:D7:FA:F8:61:AF:9E:F4:90:E7:26:B5:D6:5A:D5
      - SHA1: nil
      - #2
        contentType: pkcs7-data
        signingTime: 2010-11-18 15:48:46 UTC
        messageDigest:
        7b 05 97 02 9d 9f 38 0e 8b 41 f4 8e 17 8a 12 45 |{.....8..A.....E| a7 bb 50 32 |..P2 |
      - rsaEncryption:
        13 17 00 38 e5 01 e4 72 49 f4 2d bc fc 82 b9 bb |...8...rI.-.....| a0 4f 03 3f 85 ba 4e 9a 3d 9c 2d fa 8a 22 b0 a7 |.O.?..N.=.-.."..| ae 27 3d ec fc 3c 21 47 15 3a 1e e2 71 ee d4 d6 |.'=..

show previews

offset	size	type	comment
0	1156608	EXE	10/05/2010 20:39:22	#
15c1	15	HTM		#
7b7d0	8698	GIF	(0 x 18759)	#
e6b412	316928	DLL	08/03/2009 16:01:09	#
4908b0c	892928	EXE	05/17/2009 17:40:33	#
49e2b18	355328	EXE	01/01/1970 00:00:00	#
4a39718	387584	EXE	11/18/2010 15:42:07	#
66c0f80	579584	DLL	09/20/2010 15:39:43	#
674fc20	1156608	EXE	10/05/2010 20:39:22	#
67cb3f0	8698	GIF	(0 x 18759)	#
686a220	2856256	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

anno1404_1.3.exe- InstallShield Setup.exe - InstallScript Setup Launcher

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

Signers (1)

Certificates (4)

anno1404_1.3.exe
- InstallShield Setup.exe - InstallScript Setup Launcher