filename | 传奇登陆器.exe | |
---|---|---|
size | 8022030 (0x7a680e) | |
md5 | 42ef4fa87d0a9bf5e78502dd4f0890fb | |
type | PE32 executable (GUI) Intel 80386, for MS Windows | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x90 |
blocks_in_file | 3 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0 |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0 |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0x120 |
Rich Header
lib id | version | times used |
---|---|---|
12 | 7291 | 6 |
11 | 8047 | 9 |
10 | 8047 | 6 |
14 | 7299 | 44 |
19 | 8022 | 45 |
93 | 2179 | 2 |
1 | 0 | 716 |
19 | 8034 | 31 |
11 | 9782 | 115 |
10 | 9782 | 221 |
11 | 8168 | 117 |
10 | 8168 | 27 |
0 | 0 | 119 |
6 | 1735 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
This file is packed with ASPack. Analysis will be incomplete without unpacking. |
Sections
Data Directory
type | va | size | |
---|---|---|---|
EXPORT | 0 | 0 | |
IMPORT | 0x54a008 | 0x31c | |
RESOURCE | 0x543000 | 0x5118 | |
EXCEPTION | 0 | 0 | |
SECURITY | 0 | 0 | |
BASERELOC | 0x549fb0 | 8 | |
DEBUG | 0 | 0 | |
ARCHITECTURE | 0 | 0 | |
GLOBALPTR | 0 | 0 | |
TLS | 0 | 0 | |
LOAD_CONFIG | 0 | 0 | |
Bound_IAT | 0 | 0 | |
IAT | 0 | 0 | |
Delay_IAT | 0 | 0 | |
CLR_Header | 0 | 0 | |
0 | 0x100000 |
module_name | hint | ord | function_name |
---|---|---|---|
kernel32.dll | GetProcAddress | ||
kernel32.dll | GetModuleHandleA | ||
kernel32.dll | LoadLibraryA | ||
rasapi32.dll | RasHangUpA | ||
winmm.dll | midiStreamRestart | ||
ws2_32.dll | 18 | ||
user32.dll | wsprintfA | ||
gdi32.dll | PtVisible | ||
winspool.drv | OpenPrinterA | ||
advapi32.dll | RegQueryValueA | ||
shell32.dll | ShellExecuteA | ||
ole32.dll | StgCreateDocfileOnILockBytes | ||
oleaut32.dll | 23 | ||
comctl32.dll | ImageList_Read | ||
oledlg.dll | 8 | ||
wininet.dll | InternetCanonicalizeUrlA | ||
comdlg32.dll | ChooseColorA |
Scanning the drive for archives: 1 file, 8022030 bytes (7835 KiB) -- Type = zip WARNINGS: There are data after the end of archive Offset = 4330616 Physical Size = 984 Tail Size = 3690430 Date Time Attr Size Compressed Name ------------------- ----- ------------ ------------ ------------------------ 2017-08-16 15:32:28 D.... 0 0 Config 2017-08-16 15:32:28 D.... 0 0 Data 2017-08-16 15:32:28 D.... 0 0 Map 2017-08-16 15:32:28 D.... 0 0 Resources 2017-08-16 15:32:28 D.... 0 0 Resources/Data 2017-08-16 15:32:28 D.... 0 0 Resources/Map 2017-08-16 15:32:28 D.... 0 0 Resources/Wav 2017-08-16 15:32:28 D.... 0 0 Wav ------------------- ----- ------------ ------------ ------------------------ 2017-08-16 15:32:28 0 0 0 files, 8 folders Warnings: 1
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
[?] can't find file_offset of VA 0x5462e0
[?] can't find file_offset of VA 0x546430
[?] can't find file_offset of VA 0x546580
[?] can't find file_offset of VA 0x5466b8
[?] can't find file_offset of VA 0x547ad0
[?] can't find file_offset of VA 0x546798
[?] can't find file_offset of VA 0x546e68
[?] can't find file_offset of VA 0x546f20
[?] can't find file_offset of VA 0x547090
[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x546048
[?] can't find file_offset of VA 0x546058
[?] can't find file_offset of VA 0x545d30
[?] can't find file_offset of VA 0x545dc8
[?] can't find file_offset of VA 0x545f48
[?] can't find file_offset of VA 0x5459f8
[?] can't find file_offset of VA 0x545870
[?] can't find file_offset of VA 0x545928
[?] can't find file_offset of VA 0x545ae8
[?] can't find file_offset of VA 0x546d80
[?] can't find file_offset of VA 0x545ba0
[?] can't find file_offset of VA 0x5471d8
[?] can't find file_offset of VA 0x547228
[?] can't find file_offset of VA 0x547258
[?] can't find file_offset of VA 0x5472d0
[?] can't find file_offset of VA 0x547620
[?] can't find file_offset of VA 0x5474d8
[?] can't find file_offset of VA 0x547498
[?] can't find file_offset of VA 0x547a40
[?] can't find file_offset of VA 0x547750
[?] can't find file_offset of VA 0x547928
[?] can't find file_offset of VA 0x547aa8
[?] can't find file_offset of VA 0x546568
[?] can't find file_offset of VA 0x546418
[?] can't find file_offset of VA 0x546770
[?] can't find file_offset of VA 0x0