filenamerohanclient.exe
size4518912 (0x44f400)
md5feb99b4a8f8086099ff7ba088281c257
typePE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number2
reserved00
oem_id0
oem_info0
reserved20x381ee0f4
reserved30xdf027e43
reserved40
reserved50x82f3f059
reserved60xa9609b63
lfanew0x138

Rich Header

lib idversiontimes used
1181689
10520677
15307757
95217910
9320672
953077255
481682
484474
95206712
1884446
299178132
2891784
2592108
10552
93217929
9630771545
9430521
9030771

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections3
TimeDateStamp0x56c6d5a4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion7.10
SizeOfCode0x44e000
SizeOfInitializedData0x2000
SizeOfUninitializedData0x6cb000
AddressOfEntryPoint0xb19880
BaseOfCode0x6cc000
BaseOfData0xb1a000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xb1c000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

namevavsizeraw sizeflags
UPX00x10000x6cb0000RWX UDATA
UPX10x6cc0000x44e0000x44da00RWX IDATA
.rsrc0xb1a0000x20000x1600RW- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xb1b1140x4b4
RESOURCE0xb1a0000x1114
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
00x100000
typenamesizecp
ICON#122160
STRING#1251520
STRING#1257920
STRING#1263460
STRING#1876860
STRING#1938720
STRING#2007600
STRING#20131060
STRING#2014800
STRING#2019360
GROUP_ICON#102200
VERSION#17120
MANIFEST#16480
idlangstring
200001042ꏰꘪ෍婼ꫨ㿢ි늷㥞﻽㶃섫꫶슓栀뼕悸ැᨰ䥧櫠봈൚
200961042窉堄쀹㪭赇푽ꁟ疍䟬螃ꊊ⇬䣰榏䩘鿼Ѿ䁗˼ᳫ侼৽䇹酂ﾅ盿雵띱뿪猪呂鍚뀲竀Đ黛㛸幫悇룆
201921042胓ቁ藴價᝶샃胘ࡀ緐ᚗ讦妘腓﹁჎ᖀ‟ᓨल
300001042
ee 09 c3 a0 06 b2 c6 46  84 28 ac 20 87 7e 19 be  |.......F.(. .~..|
b1 c1 e3 30 38 71 b8 59  f5 92 7c 40 70 a5 02 c1  |...08q.Y..|@p...|
ea 65 8a 40 4a 27 ba 48  94 75 db dd 8a 20 c3 c0  |.e.@J'.H.u... ..|
2e fe 68 6c d1 50 78 31  1d 74 08 05 74 7e 66 8b  |..hl.Px1.t..t~f.|
4e a5 0b c1 8e 81 9f 97  42 c1 76 d4 a3 cb 4a a8  |N.......B.v...J.|
e8 39 0c f0 0f 41                                 |.9...A          |
309921042먘駿芎孫༦㪌蜅ꨣด卓繚㕝…誃뿛䁀쪂ཎ냑憯ਲ⹅쌻ਲ㗗樐借쵭譂悁欆፛꦳
320961042攏箸䓧疘ᓖ얅偻缢蔅罧℩ﱵⰮ晘ू棅盧胖ર锡겅큧︖藀㚘␋송蓡灴
321921042脀퐄䫊清ᘴ⩁ⵋ鏯秓컝Ꮆ㲣蜈嫣䄽蘥꽛⍖퀃㇆枭獶썀⠗⣭郀訐圄ꁁ⑶嘇䴈ڎ퐘孞䘫뺍橼fl뫜쉭㽌䐐蔄祤﬍尢惑黿
322081042
a7 bb db e5 89 34 8b aa  fe 86 8c 10 79 c2 53 19  |.....4......y.S.|
80 03 64 dd 82 58 0d f5  40 94 46 1c 45 38 f1 a1  |..d..X..@.F.E8..|
18 22 fe 6e 85 26 c7 75  86 fd 89 10 2a 83 66 1c  |.".n.&.u....*.f.|
00 33 25 0b 3a 6a 49 2c  20 88 c3 ee 47 47 0c 8b  |.3%.:jI, ...GG..|
c0 aa 76 12 fe 88 c5 a7  4d dd 7d 24 80 b8 11 00  |..v.....M.}$....|
322881042
7f 1c a6 0c de 95 ba bf  76 da 0e 1a 73 de e9 2d  |........v...s..-|
aa 68 fe 12 d6 7f 1f bd  40 9b 3f 0c 82 38 e4 45  |.h......@.?..8.E|
5b 87 e9 64                                       |[..d            |
module_namehintordfunction_name
advapi32.dllRegCloseKey
avifil32.dllAVIFileInit
d3d9.dllDirect3DCreate9
dbghelp.dllMiniDumpWriteDump
dinput8.dllDirectInput8Create
fmod.dll_FSOUND_Init@12
gdi32.dllBitBlt
imm32.dllImmNotifyIME
iphlpapi.dllGetAdaptersInfo
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLExitProcess
KERNEL32.DLLGetProcAddress
KERNEL32.DLLVirtualProtect
libeay32.dllRC4
npkcrypt.dllNPKCloseDriver
ole32.dllCoInitialize
oleaut32.dllVariantInit
shell32.dllShellExecuteA
shlwapi.dllwnsprintfA
user32.dllGetDC
version.dllVerQueryValueA
wininet.dllFtpPutFileA
winmm.dllmmioRead
ws2_32.dllrecv

StringTable 040904b0

CompanyNameYNK Games
FileDescriptionRohan Online Game
FileVersion1, 0, 4, 905
InternalNameRohanClient
LegalCopyrightCopyright (C) 2005
OriginalFilenameRohanClient
ProductNameRohan
ProductVersion1, 0, 4, 905

VS_FIXEDFILEINFO

FileVersion1.0.4.905
ProductVersion1.0.4.905
StrucVersion0x10000
FileFlagsMask0x17
FileFlags0
FileOS4
FileType0
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d04513328BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







[!] string size(38152) > stringtable size(52). truncated to 50
[!] string size(35354) > stringtable size(92). truncated to 90
[!] string size(33808) > stringtable size(46). truncated to 44
[!] string size(5084) > stringtable size(86). truncated to 84
[!] cannot convert "\xC3\xA0\x06\xB2\xC6F\x84(\xAC \x87~\x19\xBE\xB1\xC1"... to UTF-16
[!] string size(23912) > stringtable size(72). truncated to 70
[!] string size(70718) > stringtable size(60). truncated to 58
[!] string size(32632) > stringtable size(106). truncated to 104
[!] string size(96078) > stringtable size(80). truncated to 78
[!] cannot convert "\xDB\xE5\x894\x8B\xAA\xFE\x86\x8C\x10y\xC2S\x19\x80\x03"... to UTF-16
[!] string size(14590) > stringtable size(36). truncated to 34
[!] cannot convert "\xA6\f\xDE\x95\xBA\xBFv\xDA\x0E\x1As\xDE\xE9-\xAAh"... to UTF-16
[?] can't find file_offset of VA 0x0