sfArk.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	sfArk.exe
size	354304 (0x56800)
md5	041d0e1a407d5398c3b21f8440465814

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x44
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x7fd6a761
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818e
Magic	0x10b
LinkerVersion	2.50
SizeOfCode	0x86000
SizeOfInitializedData	0x12800
SizeOfUninitializedData	0x6ac00
AddressOfEntryPoint	0x125001
BaseOfCode	0x1000
BaseOfData	0x87000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x134000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.11c

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text\|	0x1000	0x86000	0x3d200	RW- IDATA
.bss\|	0x87000	0x6aacc	0x6ac00	RW- IDATA
.data\|	0xf2000	0x10000	0x4400	RW- IDATA
.idata	0x102000	0x3000	0x1000	RW- IDATA
.rsrc	0x105000	0x1a000	0x6000	RW- IDATA
.reloc	0x11f000	0x6000	0	RW- IDATA
.a9430	0x125000	0xe000	0xde00	RW- IDATA
.data	0x133000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x126248	0x22c
RESOURCE	0x105000	0x19c04
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x1260f0	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

show previews

type	name	size
DABDUMP	WCDIALOG_RSC	10591
DABDUMP	WCMAIN_RSC	5403
IMAGE	BUTTON_BMP	1782
IMAGE	DELBTN_BMP	1782
IMAGE	MM-SFARK_GIF	2888
IMAGE	REDFOLD_GIF	949
IMAGE	REDPICK_GIF	943
IMAGE	REDQUILL_GIF	1033
IMAGE	RED_X_GIF	927
IMAGE	STONE1_JPG	2480
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	308
BITMAP	SPLASHBITMAP	136
BITMAP	TOPLOGO	1834
BITMAP	#1	1508
BITMAP	#2	1508
BITMAP	#30994	184
ICON	#5	744
ICON	#6	744
ICON	#7	744
ICON	#8	744
ICON	#9	744
ICON	#10	744
ICON	#11	744
ICON	#12	744
ICON	#13	744
ICON	#14	744
ICON	#15	744
ICON	#16	296
ICON	#17	872
ICON	#18	744
ICON	#19	2216
ICON	#20	3240
ICON	#21	3752
ICON	#22	7336
ICON	#23	744
ICON	#24	744
ICON	#25	744
ICON	#26	744
ICON	#27	744
ICON	#28	744
ICON	#29	744
ICON	#30	744
ICON	#31	744
ICON	#32	744
ICON	#33	744
ICON	#34	304
ICON	#35	304
ICON	#36	304
ICON	#37	744
ICON	#38	304
ICON	#39	304
ICON	#40	304
ICON	#1024	2216
ICON	#1025	2216
ICON	#1026	2216
ICON	#1027	2216
ICON	#1028	2216
ICON	#1029	2216
DIALOG	CHOOSECOLOR	1144
DIALOG	CHOOSEDIR	622
DIALOG	SPLASH	1436
DIALOG	#2	586
STRING	#1	222
STRING	#2	62
STRING	#3	458
STRING	#4	358
STRING	#5	418
STRING	#6	444
STRING	#7	78
STRING	#19	120
STRING	#20	538
STRING	#21	504
STRING	#22	222
STRING	#23	656
STRING	#24	338
STRING	#25	282
STRING	#26	560
STRING	#32	406
STRING	#33	738
STRING	#34	1168
STRING	#35	68
STRING	#38	272
STRING	#51	190
GROUP_CURSOR	#32512	20
GROUP_CURSOR	#32513	20
GROUP_CURSOR	#32514	20
GROUP_CURSOR	#32515	20
GROUP_ICON		20
GROUP_ICON	SF2FILEG_ICO	20
GROUP_ICON	SF2FILE_ICO	20
GROUP_ICON	SFARC_ICO	20
GROUP_ICON	SFARKFG_ICO	20
GROUP_ICON	SFARKFIL_ICO	20
GROUP_ICON	#32512	20
GROUP_ICON	#32513	20
GROUP_ICON	#32514	20
GROUP_ICON	#32515	20
GROUP_ICON	#32516	20
GROUP_ICON	#32517	20
GROUP_ICON	#32518	20
GROUP_ICON	#32519	20
GROUP_ICON	#32520	20
GROUP_ICON	#32521	20
GROUP_ICON	#32522	20
GROUP_ICON	#32523	104
GROUP_ICON	#32524	20
GROUP_ICON	#32525	20
GROUP_ICON	#32526	20
GROUP_ICON	#32527	20
GROUP_ICON	#32528	20
GROUP_ICON	#32529	20
GROUP_ICON	#32530	20
GROUP_ICON	#32531	20
GROUP_ICON	#32532	20
GROUP_ICON	#32533	20
GROUP_ICON	#32534	20
GROUP_ICON	#32640	20
GROUP_ICON	#32641	20
GROUP_ICON	#32642	20
GROUP_ICON	#32643	20
GROUP_ICON	#32644	20
GROUP_ICON	#32645	20
GROUP_ICON	#32646	20

module_name	hint	ord	function_name
kernel32.dll			GetProcAddress
kernel32.dll			GetModuleHandleA
kernel32.dll			LoadLibraryA
advapi32.dll			RegCloseKey
comctl32.dll			InitCommonControls
comdlg32.dll			CommDlgExtendedError
gdi32.dll			BitBlt
lsunpa32.dll			LSP_DECRYPTKEY
sfarkl.dll			_x01_memcomp
shell32.dll			DragAcceptFiles
user32.dll			AdjustWindowRect
winspool.drv			ClosePrinter

show previews

offset	size	type	comment
0	354304	EXE	12/18/2037 18:33:05	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x10b6f0

[?] can't find file_offset of VA 0x10c238

[?] can't find file_offset of VA 0x10c5f0

[?] can't find file_offset of VA 0x10c9a0

[?] can't find file_offset of VA 0x10cdac

[?] can't find file_offset of VA 0x10d14c

[?] can't find file_offset of VA 0x10dafc

[?] can't find file_offset of VA 0x10dc30

[?] can't find file_offset of VA 0x10dd64

[?] can't find file_offset of VA 0x10de98

[?] can't find file_offset of VA 0x10dfcc

[?] can't find file_offset of VA 0x10e054

[?] can't find file_offset of VA 0x10e780

[?] can't find file_offset of VA 0x10ed64

[?] can't find file_offset of VA 0x10f348

[?] can't find file_offset of VA 0x11ba00

[?] can't find file_offset of VA 0x11be78

[?] can't find file_offset of VA 0x11c0e8

[?] can't find file_offset of VA 0x11c684

[?] can't find file_offset of VA 0x11c8d0

[?] can't find file_offset of VA 0x11c9b0

[?] can't find file_offset of VA 0x11c9f0

[?] can't find file_offset of VA 0x11cbbc

[?] can't find file_offset of VA 0x11cd24

[?] can't find file_offset of VA 0x11cec8

[?] can't find file_offset of VA 0x11d084

[?] can't find file_offset of VA 0x11d0d4

[?] can't find file_offset of VA 0x11d14c

[?] can't find file_offset of VA 0x11d368

[?] can't find file_offset of VA 0x11d560

[?] can't find file_offset of VA 0x11d640

[?] can't find file_offset of VA 0x11d8d0

[?] can't find file_offset of VA 0x11da24

[?] can't find file_offset of VA 0x11db40

[?] can't find file_offset of VA 0x11dd70

[?] can't find file_offset of VA 0x11df08

[?] can't find file_offset of VA 0x11e1ec

[?] can't find file_offset of VA 0x11e67c

[?] can't find file_offset of VA 0x11e6c0

[?] can't find file_offset of VA 0x11e7d0

[?] can't find file_offset of VA 0x11e890

[?] can't find file_offset of VA 0x11e8a4

[?] can't find file_offset of VA 0x11e8b8

[?] can't find file_offset of VA 0x11e8cc

[?] can't find file_offset of VA 0x0