filenameI Wanna Lockpick.exe
size60660736 (0x39d9c00)
md5bd6ed92d2f95063e704383682c219063
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavscan pending
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
205655016
2076550114
2066550169
2036550117
10199
210655019
126507271
201655011
204655011

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x525b8623
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0x6600
SizeOfInitializedData0x39d3200
SizeOfUninitializedData0
AddressOfEntryPoint0x67cc
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.3
ImageVersion6.3
SubsystemVersion5.1
Reserved10
SizeOfImage0x39df000
SizeOfHeaders0x400
CheckSum0x39edb11
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x40000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

FASM v1.5x

Sections

namevavsizeraw sizeflags
.text0x10000x65cc0x6600R-X CODE
.data0x80000x1a8c0x400RW- IDATA
.idata0xa0000x10780x1200R-- IDATA
.rsrc0xc0000x39d07380x39d0800R-- IDATA
.reloc0x39dd0000x13ae0x1400R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xa2900xb4
RESOURCE0xc0000x39d0738
EXCEPTION00
SECURITY00
BASERELOC0x39dd0000x850
DEBUG0x10200x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x13580x40
Bound_IAT00
IAT0xa0000x290
Delay_IAT00
CLR_Header00
typenamesizecp
AVI#3001118021252
ICON#111281252
ICON#243921252
ICON#398321252
DIALOG#20017541252
DIALOG#20024321252
DIALOG#20033581252
DIALOG#20044481252
DIALOG#20053041252
DIALOG#20062881252
STRING#631401252
STRING#7613121252
STRING#7714841252
STRING#8012001252
STRING#8310981252
STRING#859741252
RCDATAADMQCMD71252
RCDATACABINET605808111252
RCDATAEXTRACTOPT41252
RCDATAFILESIZES361252
RCDATAFINISHMSG71252
RCDATALICENSE71252
RCDATAPACKINSTSPACE41252
RCDATAPOSTRUNPROGRAM71252
RCDATAREBOOT41252
RCDATARUNPROGRAM231252
RCDATASHOWWINDOW41252
RCDATATITLE151252
RCDATAUPROMPT71252
RCDATAUSRQCMD71252
GROUP_ICON#3000481252
VERSION#121081252
MANIFEST#115111252
idlangstring
10001033Please select a folder to store the extracted files.
10011033%s
12001033Failed to get disk space information from: %s. System Message: %s.
12011033A required resource cannot be located.
12021033Are you sure you want to cancel?
12041033Unable to retrieve operating system version information.
12051033Memory allocation request failed.
12081033Unable to create extraction thread.
12101033Cabinet is not valid.
12111033Filetable full.
12121033Can not change to destination folder.
12131033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space first and press RETRY or press CANCEL to exit setup.
12141033That folder is invalid. Please make sure the folder exists and is writable.
12151033You must specify a folder with fully qualified pathname or choose Cancel.
12161033Could not update folder edit box.
12171033Could not load functions required for browser dialog.
12181033Could not load Shell32.dll required for browser dialog.
12201033Error creating process <%s>. Reason: %s
12211033The cluster size in this system is not supported.
12221033A required resource appears to be corrupted.
12231033Windows 95 or Windows NT 4.0 Beta 2 or greater is required for this installation.
12241033Error loading %s
12251033GetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used.
12261033Windows 95 or Windows NT is required to install
12271033Could not create folder '%s'
12281033To install this program, you need %s KB disk space on drive %s. It is recommended that you free up the required disk space before you continue. Do you still want to continue?
12641033Error retrieving Windows folder
12691033NT Shutdown: OpenProcessToken error.
12701033NT Shutdown: AdjustTokenPrivileges error.
12711033NT Shutdown: ExitWindowsEx error.
12721033Extracting file failed. It is most likely caused by low memory (low disk space for swapping file) or corrupted Cabinet file.
12731033The setup program could not retrieve the volume information for drive (%s) . System message: %s.
12741033Setup could not find a drive with %s KB free disk space to install the program. Please free up some space and try again.
12751033The installation program appears to be damaged or corrupted. Contact the vendor of this application.
13121033Command line option syntax error. Type Command /? for Help.
13131033Command line options: /Q -- Quiet modes for package, /T:<full path> -- Specifies temporary working folder, /C -- Extract files only to the folder when used also with /T. /C:<Cmd> -- Override Install Command defined by author.
13141033You must restart your computer before the new settings will take effect. Do you want to restart your computer now?
13161033Another copy of the '%s' package is already running on your system. Do you want to run another copy?
13171033Could not find the file: %s.
13511033You do not have administrator privileges on this machine. Some installations cannot be completed correctly unless they are run by an administrator.
13541033The folder '%s' does not exist. Do you want to create it?
13551033Another copy of the '%s' package is already running on your system. You can only run one copy at a time.
13561033The '%s' package is not compatible with the version of Windows you are running.
13571033The '%s' package is not compatible with the version of the file: %s on your system.
module_namehintordfunction_name
ADVAPI32.dll530OpenProcessToken
ADVAPI32.dll367GetTokenInformation
ADVAPI32.dll673RegSetValueExA
ADVAPI32.dll280EqualSid
ADVAPI32.dll657RegQueryValueExA
ADVAPI32.dll428LookupPrivilegeValueA
ADVAPI32.dll604RegCreateKeyExA
ADVAPI32.dll644RegOpenKeyExA
ADVAPI32.dll651RegQueryInfoKeyA
ADVAPI32.dll619RegDeleteValueA
ADVAPI32.dll32AllocateAndInitializeSid
ADVAPI32.dll307FreeSid
ADVAPI32.dll31AdjustTokenPrivileges
ADVAPI32.dll596RegCloseKey
KERNEL32.dll659GetPrivateProfileIntA
KERNEL32.dll560GetFileAttributesA
KERNEL32.dll869IsDBCSLeadByte
KERNEL32.dll716GetSystemDirectoryA
KERNEL32.dll809GlobalUnlock
KERNEL32.dll698GetShortPathNameA
KERNEL32.dll173CreateDirectoryA
KERNEL32.dll364FindFirstFileA
KERNEL32.dll592GetLastError
KERNEL32.dll669GetProcAddress
KERNEL32.dll1169RemoveDirectoryA
KERNEL32.dll1267SetFileAttributesA
KERNEL32.dll798GlobalFree
KERNEL32.dll360FindClose
KERNEL32.dll665GetPrivateProfileStringA
KERNEL32.dll933LoadLibraryA
KERNEL32.dll942LocalAlloc
KERNEL32.dll1508WritePrivateProfileStringA
KERNEL32.dll610GetModuleFileNameA
KERNEL32.dll381FindNextFileA
KERNEL32.dll144CompareStringA
KERNEL32.dll1525_lopen
KERNEL32.dll127CloseHandle
KERNEL32.dll946LocalFree
KERNEL32.dll263DeleteFileA
KERNEL32.dll337ExitProcess
KERNEL32.dll282DosDateTimeToFileTime
KERNEL32.dll186CreateFileA
KERNEL32.dll390FindResourceA
KERNEL32.dll791GlobalAlloc
KERNEL32.dll340ExpandEnvironmentStringsA
KERNEL32.dll939LoadResource
KERNEL32.dll1449WaitForSingleObject
KERNEL32.dll1263SetEvent
KERNEL32.dll615GetModuleHandleW
KERNEL32.dll409FormatMessageA
KERNEL32.dll1279SetFileTime
KERNEL32.dll1503WriteFile
KERNEL32.dll542GetDriveTypeA
KERNEL32.dll774GetVolumeInformationA
KERNEL32.dll1376TerminateThread
KERNEL32.dll1359SizeofResource
KERNEL32.dll179CreateEventA
KERNEL32.dll556GetExitCodeProcess
KERNEL32.dll215CreateProcessA
KERNEL32.dll1524_llseek
KERNEL32.dll1249SetCurrentDirectoryA
KERNEL32.dll736GetTempFileNameA
KERNEL32.dll1185ResetEvent
KERNEL32.dll957LockResource
KERNEL32.dll720GetSystemInfo
KERNEL32.dll934LoadLibraryExA
KERNEL32.dll206CreateMutexA
KERNEL32.dll514GetCurrentDirectoryA
KERNEL32.dll772GetVersionExA
KERNEL32.dll771GetVersion
KERNEL32.dll738GetTempPathA
KERNEL32.dll232CreateThread
KERNEL32.dll944LocalFileTimeToFileTime
KERNEL32.dll1275SetFilePointer
KERNEL32.dll783GetWindowsDirectoryA
KERNEL32.dll1532lstrcmpA
KERNEL32.dll1522_lclose
KERNEL32.dll802GlobalLock
KERNEL32.dll521GetCurrentProcess
KERNEL32.dll417FreeResource
KERNEL32.dll414FreeLibrary
KERNEL32.dll1360Sleep
KERNEL32.dll701GetStartupInfoA
KERNEL32.dll1408UnhandledExceptionFilter
KERNEL32.dll1345SetUnhandledExceptionFilter
KERNEL32.dll1375TerminateProcess
KERNEL32.dll1017OutputDebugStringA
KERNEL32.dll1196RtlUnwind
KERNEL32.dll612GetModuleHandleA
KERNEL32.dll1069QueryPerformanceCounter
KERNEL32.dll522GetCurrentProcessId
KERNEL32.dll526GetCurrentThreadId
KERNEL32.dll726GetSystemTimeAsFileTime
KERNEL32.dll754GetTickCount
KERNEL32.dll307EnumResourceLanguagesA
KERNEL32.dll976MulDiv
KERNEL32.dll536GetDiskFreeSpaceA
KERNEL32.dll1103ReadFile
GDI32.dll502GetDeviceCaps
USER32.dll308GetDC
USER32.dll695SendMessageA
USER32.dll725SetForegroundWindow
USER32.dll596MsgWaitForMultipleObjects
USER32.dll690SendDlgItemMessageA
USER32.dll459GetWindowRect
USER32.dll582MessageBoxA
USER32.dll452GetWindowLongA
USER32.dll619PeekMessageA
USER32.dll677ReleaseDC
USER32.dll316GetDlgItem
USER32.dll783SetWindowPos
USER32.dll800ShowWindow
USER32.dll180DispatchMessageA
USER32.dll787SetWindowTextA
USER32.dll228EnableWindow
USER32.dll29CallWindowProcA
USER32.dll174DialogBoxIndirectParamA
USER32.dll318GetDlgItemTextA
USER32.dll559LoadStringA
USER32.dll581MessageBeep
USER32.dll57CharUpperA
USER32.dll47CharNextA
USER32.dll260ExitWindowsEx
USER32.dll50CharPrevA
USER32.dll231EndDialog
USER32.dll311GetDesktopWindow
USER32.dll721SetDlgItemTextA
USER32.dll780SetWindowLongA
USER32.dll426GetSystemMetrics
msvcrt.dll1295memset
msvcrt.dll55void __cdecl terminate(void)

?terminate@@YAXXZ

msvcrt.dll313_controlfp
msvcrt.dll1291memcpy
msvcrt.dll521_ismbblead
msvcrt.dll208__p__fmode
msvcrt.dll294_cexit
msvcrt.dll373_exit
msvcrt.dll1200exit
msvcrt.dll228__set_app_type
msvcrt.dll163__getmainargs
msvcrt.dll249_acmdln
msvcrt.dll490_initterm
msvcrt.dll275_amsg_exit
msvcrt.dll203__p__commode
msvcrt.dll113_XcptFilter
msvcrt.dll361_errno
msvcrt.dll1000_vsnprintf
msvcrt.dll230__setusermatherr
COMCTL32.dll17
Cabinet.dll22
Cabinet.dll23
Cabinet.dll21
Cabinet.dll20
VERSION.dllGetFileVersionInfoA
VERSION.dll4GetFileVersionInfoSizeA
VERSION.dll15VerQueryValueA

StringTable 040904B0

CompanyName
FileDescription
FileVersion1.0.0.0
InternalNameWextract
LegalCopyright
OriginalFilenameWEXTRACT.EXE .MUI
ProductName
ProductVersion1.0.0.0

VS_FIXEDFILEINFO

FileVersion1.0.0.0
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
881811794AVI#
b62a60614102BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 60660736 bytes (58 MiB)


--
Type = PE
WARNING = Checksum error
Physical Size = 60660736
CPU = x86
Characteristics = Executable 32-bit
Created = 2013-10-14 05:50:27
Headers Size = 1024
Checksum = 60742417
Name = WEXTRACT.EXE            .MUI
Image Size = 60682240
Section Alignment = 4096
File Alignment = 512
Code Size = 26112
Initialized Data Size = 60633600
Uninitialized Data Size = 0
Linker Version = 11.0
OS Version = 6.3
Image Version = 6.3
Subsystem Version = 5.1
Subsystem = Windows GUI
DLL Characteristics = Relocated NX-Compatible TerminalServerAware
Stack Reserve = 262144
Stack Commit = 8192
Heap Reserve = 1048576
Heap Commit = 4096
Image Base = 4194304
Comment = FileVersion: 1.0.0.0
FileVersion: 1.0.0.0                                   
ProductVersion: 1.0.0.0
ProductVersion: 1.0.0.0         
CompanyName:                      
FileDescription:                                                                        
InternalName: Wextract                
LegalCopyright:                                              
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName:                  
----
Path = .rsrc/RCDATA/CABINET
Size = 60580811
Packed Size = 60580811
--
Path = .rsrc/RCDATA/CABINET
Type = Cab
Physical Size = 60580811
Method = LZX:21
Blocks = 1
Volumes = 1
Volume Index = 0
ID = 39480

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2018-09-12 20:10:06 ....A      1998168               D3DX9_43.dll
2021-12-01 22:49:30 ....A     14656446               data.win
2021-12-01 22:49:24 ....A         2560               gmsched.dll
2021-12-01 22:49:32 ....A      4396032               I Wanna Lockpick.exe
2021-11-17 21:19:08 ....A      2834264               musAutumn.ogg
2021-11-17 21:18:26 ....A      1344614               musBackside.ogg
2021-11-17 21:19:00 ....A      3090884               musC.ogg
2021-11-17 21:18:50 ....A      2123855               musClouds.ogg
2021-11-17 21:18:44 ....A      2654269               musClouds2.ogg
2021-11-17 21:18:42 ....A      4683981               musClouds3.ogg
2021-11-17 21:18:42 ....A      3098433               musDark.ogg
2021-11-17 21:18:40 ....A      3144555               musDolls.ogg
2021-11-17 21:18:58 ....A      2775887               musEBF.ogg
2021-11-17 21:18:58 ....A       559163               musEnding.ogg
2021-11-17 21:18:48 ....A      1652373               musFinale.ogg
2021-11-17 21:18:54 ....A      2693009               musGreatBeyond.ogg
2021-11-17 21:18:30 ....A      2867539               musHarvest.ogg
2021-11-17 21:18:26 ....A      1933593               musKlonoa.ogg
2021-11-17 21:18:18 ....A      2560603               musLeaves.ogg
2021-11-17 21:19:06 ....A      2319896               musMonolith.ogg
2021-11-17 21:18:10 ....A       141400               musOnDeath.ogg
2021-11-19 16:16:14 ....A       241274               musPause.ogg
2021-11-17 21:18:20 ....A      2401284               musReedz.ogg
2021-11-17 21:18:56 ....A      3253914               musSkyTower.ogg
2021-11-17 21:18:18 ....A      2103769               musSwimming.ogg
2021-11-17 21:18:22 ....A       634381               musTitle.ogg
2021-11-17 21:18:28 ....A      3049037               musUrethra.ogg
2021-11-17 21:18:34 ....A       730616               musWind.ogg
2021-12-01 22:49:16 ....A           97               options.ini
2021-11-17 21:18:58 ....A        23195               sndLevel.ogg
2021-11-17 21:18:54 ....A        29284               sndWin.ogg
------------------- ----- ------------ ------------  ------------------------
2021-12-01 22:49:32           73998375     60660736  31 files

Warnings: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK