| filename | rohanclient.exe | |
|---|---|---|
| size | 2839040 (0x2b5200) | |
| md5 | 197b06926b6be81d2da139ebb2b09849 | |
| type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | |
| mimetype | application/x-dosexec | |
| clamav | OK | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x90 |
| blocks_in_file | 3 |
| num_relocs | 0 |
| header_paragraphs | 4 |
| min_extra_paragraphs | 0 |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0xb8 |
| checksum | 0 |
| ip | 0 |
| cs | 0 |
| reloc_table_offset | 0x40 |
| overlay_number | 0 |
| reserved0 | 0 |
| oem_id | 0 |
| oem_info | 0 |
| reserved2 | 0 |
| reserved3 | 0 |
| reserved4 | 0 |
| reserved5 | 0 |
| reserved6 | 0 |
| lfanew | 0x128 |
Rich Header
| lib id | version | times used |
|---|---|---|
| 105 | 2067 | 7 |
| 15 | 3077 | 67 |
| 95 | 2179 | 10 |
| 93 | 2067 | 2 |
| 95 | 3077 | 250 |
| 4 | 8168 | 4 |
| 4 | 8447 | 4 |
| 95 | 2067 | 12 |
| 18 | 8444 | 6 |
| 29 | 9178 | 132 |
| 28 | 9178 | 4 |
| 25 | 9210 | 8 |
| 1 | 0 | 514 |
| 93 | 2179 | 29 |
| 96 | 3077 | 1480 |
| 94 | 3052 | 1 |
| 90 | 3077 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
UPX v0.89.6 - v1.02 / v1.05 - v1.22 This file is packed with UPX. Analysis will be incomplete without unpacking. |
Sections
| name | va | vsize | raw size | flags | |
|---|---|---|---|---|---|
| UPX0 | 0x1000 | 0x83c000 | 0 | RWX UDATA | |
| UPX1 | 0x83d000 | 0x2b4000 | 0x2b3800 | RWX IDATA | |
| .rsrc | 0xaf1000 | 0x2000 | 0x1600 | RW- IDATA |
Data Directory
| type | va | size | |
|---|---|---|---|
| EXPORT | 0 | 0 | |
| IMPORT | 0xaf2114 | 0x4d8 | |
| RESOURCE | 0xaf1000 | 0x1114 | |
| EXCEPTION | 0 | 0 | |
| SECURITY | 0 | 0 | |
| BASERELOC | 0 | 0 | |
| DEBUG | 0 | 0 | |
| ARCHITECTURE | 0 | 0 | |
| GLOBALPTR | 0 | 0 | |
| TLS | 0 | 0 | |
| LOAD_CONFIG | 0 | 0 | |
| Bound_IAT | 0 | 0 | |
| IAT | 0 | 0 | |
| Delay_IAT | 0 | 0 | |
| CLR_Header | 0 | 0 |
| type | name | size | cp | |
|---|---|---|---|---|
| ICON | #1 | 2216 | 0 | |
| STRING | #1251 | 52 | 0 | |
| STRING | #1257 | 92 | 0 | |
| STRING | #1263 | 46 | 0 | |
| STRING | #1876 | 86 | 0 | |
| STRING | #1938 | 72 | 0 | |
| STRING | #2007 | 60 | 0 | |
| STRING | #2013 | 106 | 0 | |
| STRING | #2014 | 80 | 0 | |
| STRING | #2019 | 36 | 0 | |
| GROUP_ICON | #102 | 20 | 0 | |
| VERSION | #1 | 712 | 0 | |
| MANIFEST | #1 | 648 | 0 |
| id | lang | string |
|---|---|---|
| 20000 | 1042 | d0 48 10 d4 e6 d2 5c 9a 4c d8 50 f0 54 a5 b9 34 |.H....\.L.P.T..4| 97 f4 58 f8 5c bc cd a5 5d da 60 8e 1c 64 22 dc |..X.\...].`..d".| 68 fc 97 e6 d2 7c 59 0c c0 10 c4 14 b4 4b bb 34 |h....|Y......K.4| 20 18 10 24 | ..$ | |
| 20096 | 1042 | b4 4b bb 20 10 e4 24 34 00 28 10 2b 18 24 4e 04 |.K. ..$4.(.+.$N.|
ea 8d a6 69 da 66 44 0a 30 48 34 4c 42 88 1b 84 |...i.fD.0H4LB...|
8f e2 18 72 4f bd 5f 1f 03 34 ab 73 1c 6e 6f 22 |...rO._..4.s.no"|
3c 89 2d 68 24 b9 7f ae 14 9e 67 e5 b3 6f 0e 1c |<.-h$.....g..o..|
10 e4 2a 36 1a 05 0a 34 e7 0d 94 b8 7b 98 a3 30 |..*6...4....{..0|
10 24 ce 2e 55 1b ce dd ca 26 1d df |.$..U....&.. | |
| 20192 | 1042 | e7 c8 56 28 57 e8 d9 73 6c 6f 08 57 4e b3 18 e4 |..V(W..slo.WN...| cc 56 28 dd 2e 2c f2 06 57 0a ae 0c 1d ec 56 bb |.V(..,..W.....V.| 38 d8 46 2c d1 1e b0 b2 46 3c 46 40 b1 10 |8.F,....F |
| 30000 | 1042 | ﲓ䠌䙏﵌蠭楎倨吻䅢悿ಅ㴞弸ׇ圼焠ᴁ턵ꎋ풤堭됑툴ꡠ錧ㅲ‘м뺬कᡝɑញ룘愶徵⾵ᡸ |
| 30992 | 1042 | ⱐ됉ኇ莙ೂ䐜ꕑ宰᫇耕痃逕弄ꐐ拊ᡵ埉䦨対ᐐᅬᅥ葪ȷ⃕晆⧏ꬓ逫a㟣 |
| 32096 | 1042 | bb 6a 71 88 bb 61 06 89 56 04 5c a2 0d 5c b1 3f |.jq..a..V.\..\.?| 08 06 98 24 e6 cf 1e 0b a3 89 02 da 76 20 15 d1 |...$........v ..| 78 3d ac c3 a5 7e 33 a4 25 ac 62 83 74 00 24 2c |x=...~3.%.b.t.$,| df ba 98 12 09 b3 d6 13 96 c0 d6 77 |...........w | |
| 32192 | 1042 | c3 9b 24 71 6c 15 7b b2 28 1c be c3 9a 37 08 10 |..$ql.{.(....7..|
a1 44 73 04 74 32 03 3e e1 3c ed cb 47 5e 25 26 |.Ds.t2.>.<..G^%&|
f3 24 b1 75 24 ff 5c 25 01 67 7f 24 6c 61 0b 77 |.$.u$.\%.g.$la.w|
29 18 89 6d c7 2b 10 8e 24 ce 5f 20 e9 de 33 03 |)..m.+..$._ ..3.|
ed 63 3f 88 41 24 04 25 72 34 eb 34 00 e8 3b c8 |.c?.A$.%r4.4..;.|
9d ee 66 b8 05 5f 8c 95 e8 33 8b 76 20 1a 23 79 |..f.._...3.v .#y|
28 1f 72 32 3c 80 40 05 61 7f |(.r2<.@.a. | |
| 32208 | 1042 | 48 22 1a 63 b0 2d 37 7c 45 05 61 3f f0 99 b2 84 |H".c.-7|E.a?....| 69 9c a6 74 cc 82 32 56 15 3b 02 40 9c 96 bf 60 |i..t..2V.;.@...`| b4 49 60 ed 67 31 f6 ff d7 6a f5 74 68 0c 3c 1e |.I`.g1...j.th.<.| 38 60 29 da 6b 4a 68 23 2d bd ad 70 94 34 83 e2 |8`).kJh#-..p.4..| ef 52 53 d1 c6 ee 92 69 0d cc 08 3c 0d a5 f2 dc |.RS....i...<....| |
| 32288 | 1042 | ဨ娕鴓桍ﰬဤ炎찖퀸熶惹Ԁ猻ᅬ́㮁 |
| module_name | hint | ord | function_name |
|---|---|---|---|
| KERNEL32.DLL | LoadLibraryA | ||
| KERNEL32.DLL | GetProcAddress | ||
| KERNEL32.DLL | VirtualProtect | ||
| KERNEL32.DLL | VirtualAlloc | ||
| KERNEL32.DLL | VirtualFree | ||
| KERNEL32.DLL | ExitProcess | ||
| ADVAPI32.dll | RegOpenKeyA | ||
| AVIFIL32.dll | AVIFileInit | ||
| d3d9.dll | Direct3DCreate9 | ||
| dbghelp.dll | MiniDumpWriteDump | ||
| DINPUT8.dll | DirectInput8Create | ||
| dph.ldr | __initialize | ||
| fmod.dll | _FSOUND_Init@12 | ||
| GDI32.dll | BitBlt | ||
| IMM32.dll | ImmIsIME | ||
| iphlpapi.dll | GetAdaptersInfo | ||
| LIBEAY32.dll | 341 | ||
| npkcrypt.dll | 2 | ||
| ole32.dll | CoInitialize | ||
| OLEAUT32.dll | 200 | ||
| SHELL32.dll | ShellExecuteA | ||
| SHLWAPI.dll | wnsprintfA | ||
| USER32.dll | GetDC | ||
| VERSION.dll | VerQueryValueA | ||
| WININET.dll | FtpPutFileA | ||
| WINMM.dll | mmioSeek | ||
| WS2_32.dll | 6 |
StringTable 040904b0
| CompanyName | YNK Games |
| FileDescription | Rohan Online Game |
| FileVersion | 6, 4, 0, 117 |
| InternalName | RohanClient |
| LegalCopyright | Copyright (C) 2005 |
| OriginalFilename | RohanClient |
| ProductName | Rohan |
| ProductVersion | 6, 4, 0, 117 |
VS_FIXEDFILEINFO
| FileVersion | 6.4.0.117 |
| ProductVersion | 6.4.0.117 |
| StrucVersion | 0x10000 |
| FileFlagsMask | 0x17 |
| FileFlags | 0 |
| FileOS | 4 |
| FileType | 0 |
| FileSubtype | 0 |
 |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
[!] string size(37280) > stringtable size(52). truncated to 50
[!] cannot convert "\x10\xD4\xE6\xD2\\\x9AL\xD8P\xF0T\xA5\xB94\x97\xF4"... to UTF-16
[!] string size(38760) > stringtable size(92). truncated to 90
[!] cannot convert "\xBB \x10\xE4$4\x00(\x10+\x18$N\x04\xEA\x8D"... to UTF-16
[!] string size(102862) > stringtable size(46). truncated to 44
[!] cannot convert "V(W\xE8\xD9slo\bWN\xB3\x18\xE4\xCCV"... to UTF-16
[!] string size(92182) > stringtable size(86). truncated to 84
[!] string size(72438) > stringtable size(72). truncated to 70
[!] string size(54646) > stringtable size(60). truncated to 58
[!] cannot convert "q\x88\xBBa\x06\x89V\x04\\\xA2\r\\\xB1?\b\x06"... to UTF-16
[!] string size(79750) > stringtable size(106). truncated to 104
[!] cannot convert "$ql\x15{\xB2(\x1C\xBE\xC3\x9A7\b\x10\xA1D"... to UTF-16
[!] string size(17552) > stringtable size(80). truncated to 78
[!] cannot convert "\x1Ac\xB0-7|E\x05a?\xF0\x99\xB2\x84i\x9C"... to UTF-16
[!] string size(61272) > stringtable size(36). truncated to 34