suba002.exe

info
MZ
PE
resources
strings
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	suba002.exe
size	1580468 (0x181db4)
md5	0bc30baf32320b3b5fef7f2811457831

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

Rich Header

lib id	version	times used
Rich Header present, but decode failed. Checkhexdump&log

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x55153a01
PointerToSymbolTable	1
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	47.0
SizeOfCode	0xb000
SizeOfInitializedData	0x7000
SizeOfUninitializedData	0
AddressOfEntryPoint	0xb5f2
BaseOfCode	0x1000
BaseOfData	0xc000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.5633
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x13000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	1
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0x100
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text�	0x1000	0xaff0	0xb000	R-X CODE
.rdata	0xc000	0x1eff	0x2000	R-- IDATA
.data	0xe000	0x20ff	0x2200	RW- IDATA
rc	0x11000	0x1bff	0x2000	R--

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xd648	1
RESOURCE	0x11000	0x1b00
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0x1000001
DEBUG	0	0
ARCHITECTURE	0	0x10001
GLOBALPTR	0	0xfe0000ff
TLS	0	0xff
LOAD_CONFIG	0	1
Bound_IAT	0	0
IAT	0xc000	0x218
Delay_IAT	0	0
CLR_Header	0	1

show previews

type	name	size	cp	r
BITMAP	#128	1056	0	0
MENU	#128	2415920272	0	0
DIALOG	#130	576	0	0
DIALOG	#131	70	0	0
DIALOG	#133	338	0	0
DIALOG	#137	266	0	0
DIALOG	#140	168	0	0
DIALOG	#9437325	166	0	0
STRING	#9	104	0	0
STRING	#2049	0	0	393216
STRING	#2049	3611568413	1815426729	1498205751
STRING	#2049	192	0	0
STRING	#2049	310	0	0
STRING	#2049	60	0	0
STRING	#2049	96	0	0
STRING	#2049	84	0	0
STRING	#2049	58	0	0
STRING	#2049	88	0	0
STRING	#2049	164	0	0
STRING	#2049	62	0	0
STRING	#2049	58	0	0
STRING	#2049	112	0	0
STRING	#2049	24	0	0
STRING	#2049	0	0	65536
STRING	#2049	144	8388609	23592960
STRING	#2049	0	0	8388609
STRING	#2049	242319360	51904512	243367936
STRING	#2049	2147484176	0	0
STRING	#2049	34603152	32768	0
STRING	#2049	2147484032	0	0
STRING	#2049	0	144	8388609
STRING	#2049	20447232	15826944	22020096
STRING	#2049	622592	20447232	15826944
STRING	#2049	44040192	236158976	45613056
STRING	#2049	2147484200	2049	2147484304
STRING	#2049	0	0	0
STRING	#2049	0	0	9437184
STRING	#2049	65536	128	2147484032
STRING	#2049	0	0	0
STRING	#2049	32768	0	0
STRING	#2049	0	0	65536
STRING	#2049	9437325	2147484176	0
STRING	#2049	0	0	144
STRING	#2049	0	0	393216
STRING	#2049	2147483736	5	2147483760
STRING	#2049	102975360	3627375401	946403648
STRING	#2049 / ???	1331893064	3322270350	11577261
STRING	#2049 / ???	603264122	3001564373	667575662
STRING	#2049 / ???	918914053	3829048456	2716597128
STRING	#2049 / ???	400816179	2034657392	4102661112
STRING	#2049 / ???	3808653476	1819591195	2070463615
STRING	#2049 / ???	3169041041	3890343266	3794816529
STRING	#2049 / ???	3061320918	2736291828	1952243853
STRING	#2049 / ???	683846937	3487847738	3581941684
STRING	#2049 / ???	2197715176	2108842135	2120951371
STRING	#2049 / ???	4016151965	2786134040	3812582854
STRING	#2049 / ???	4072341148	637050164	516877875
STRING	#2049 / ???	567813158	1526392956	3660511342
STRING	#2049 / ???	836530093	1163667951	128073099
STRING	#2049 / ???	191342782	3933514709	3401910624
STRING	#2049 / ???	1958264749	1820494540	2233437979
STRING	#2049 / ???	2441511914	3222178521	2266076282
STRING	#2049 / ???	1977409431	1840038666	2942305508
STRING	#2049 / ???	4053433824	2829037097	4008048175
STRING	#2049 / ???	3527275217	4020570851	3897825303
STRING	#2049 / ???	1048382471	617724856	2852244890
STRING	#2049 / ???	2459086182	942804938	3254144144
STRING	#2049 / ???	1866983509	990554412	2161421133
STRING	#2049 / ???	1449990588	756067061	30098115
STRING	#2049 / ???	3348270489	2861995903	2954153012
STRING	#2049 / ???	1987773625	992668531	313633087
STRING	#2049 / ???	3274042985	257283810	3175299167
STRING	#2049 / ???	161443888	2363500971	1004246955
STRING	#2049 / ???	2458497953	3226660487	1367586692
STRING	#2049 / ???	1516959993	111561868	1316682997
STRING	#2049 / ???	4082689704	1247846597	1154928644
STRING	#2049 / ???	838560252	4009539552	2064700042
STRING	#2049 / ???	4255942346	360428216	3160104512
STRING	#2049 / ???	3235505855	4222796351	1384547479
STRING	#2049 / ???	1505250428	1826614321	2562254859
STRING	#2049 / ???	1968522980	2872336402	3583309184
STRING	#2049 / ???	591888621	895166726	1761165528
STRING	#2049 / ???	2483155702	403822182	1629067647
STRING	#2049 / ???	3194539744	4211638421	63830319
STRING	#2049 / ???	1897171601	624098165	2804700043
STRING	#2049 / ???	877134901	1424591934	4204968164
STRING	#2049 / ???	484856324	1223849375	3491075788
STRING	#2049 / ???	2637826823	4266387063	2286411875
STRING	#2049 / ???	3279804056	58159761	634953579
STRING	#2049 / ???	3832713557	3002655922	379496266
STRING	#2049 / ???	2756506250	529970322	4183987202
STRING	#2049 / ???	1995205327	3062860947	1713814134
STRING	#2049 / ???	1942308108	2564270043	3791103045
STRING	#2049 / ???	602577329	2226590378	234488013
STRING	#2050	46	0	0
STRING	#3585	42	0	0
STRING	#3601	230	0	0

id	lang	string
128	3079	bmp Bmp Bmp.Document Bmp Document
32768	3079	?????
32769	3079	?????
32770	3079	?????
32771	3079	?????
32772	3079	?????
32773	3079	?????
32774	3079	?????
32775	3079	?????
32776	3079	?????
32777	3079	?????
32778	3079	?????
32779	3079	?????
32780	3079	?????
32781	3079	?????
32782	3079	?????
32783	3079	?????
32768	3079	?????? ??
32769	3079	???? ????
32770	3079	??????????????? ??
32771	3079	??????????????? ??
32772	3079	??????? ??
32773	3079	??????? ??
32776	3079	??????? ??
32777	3079	????????????? ??
32778	3079	?????? ????
32779	3079	???????? ??
32780	3079	???????????? ????
32773	3079	??????????? ??
32768	3079	??????,?????? ??
32769	3079	??????;?????? ??
32768	3079	???????? ????
32769	3079	???????? ????
32768	3079	???
32769	3079	??
32770	3079	??
32771	3079	??
32772	3079	??
32773	3079	??
32768	3079	???????? ?????
32769	3079	???????? ?????
32768	3079	??????
32769	3079	??????
32770	3079	????????
32771	3079	??????????
32772	3079	??????????
32773	3079	??????????
32774	3079	????????????????
32770	3079	??????????
32771	3079	?????
32773	3079	???????? ????
32768	2052	BMP文件 MS Serif倂Width:倂
32770	2052	Height:倂?Bits:
32768	2052	耤
32791	3079	???????
57344	3079	bmp
57345	3079	??
57600	3079	????? ??
57601	3079	???????? ??
57602	3079	?逿???? ??
57603	3079	?????? ??
57604	3079	?????????????? ???
57605	3079	?????? ????
57606	3079	?????????? ????
57607	3079	?????? ??
57609	3079	???? ????

module_name	hint	ord	function_name
MFC42.DLL		3798
MFC42.DLL		4837
MFC42.DLL		4441
MFC42.DLL		2648
MFC42.DLL		2055
MFC42.DLL		6376
MFC42.DLL		3749
MFC42.DLL		5065
MFC42.DLL		1727
MFC42.DLL		5261
MFC42.DLL		2446
MFC42.DLL		2124
MFC42.DLL		5277
MFC42.DLL		2982
MFC42.DLL		3147
MFC42.DLL		3259
MFC42.DLL		4465
MFC42.DLL		3136
MFC42.DLL		3262
MFC42.DLL		2985
MFC42.DLL		3081
MFC42.DLL		2976
MFC42.DLL		3402
MFC42.DLL		3830
MFC42.DLL		3831
MFC42.DLL		3825
MFC42.DLL		3079
MFC42.DLL		4080
MFC42.DLL		4627
MFC42.DLL		4424
MFC42.DLL		3610
MFC42.DLL		641
MFC42.DLL		567
MFC42.DLL		324
MFC42.DLL		825
MFC42.DLL		656
MFC42.DLL		2302
MFC42.DLL		4234
MFC42.DLL		2884
MFC42.DLL		3495
MFC42.DLL		6334
MFC42.DLL		4615
MFC42.DLL		4612
MFC42.DLL		4610
MFC42.DLL		4274
MFC42.DLL		6375
MFC42.DLL		4486
MFC42.DLL		2554
MFC42.DLL		2512
MFC42.DLL		5731
MFC42.DLL		3922
MFC42.DLL		1089
MFC42.DLL		5199
MFC42.DLL		2396
MFC42.DLL		3346
MFC42.DLL		5300
MFC42.DLL		5302
MFC42.DLL		2725
MFC42.DLL		4079
MFC42.DLL		4698
MFC42.DLL		5307
MFC42.DLL		5289
MFC42.DLL		5714
MFC42.DLL		4622
MFC42.DLL		3738
MFC42.DLL		561
MFC42.DLL		815
MFC42.DLL		6215
MFC42.DLL		617
MFC42.DLL		5301
MFC42.DLL		5214
MFC42.DLL		296
MFC42.DLL		986
MFC42.DLL		520
MFC42.DLL		823
MFC42.DLL		4159
MFC42.DLL		6117
MFC42.DLL		2621
MFC42.DLL		1134
MFC42.DLL		1825
MFC42.DLL		4238
MFC42.DLL		4696
MFC42.DLL		3058
MFC42.DLL		3065
MFC42.DLL		6336
MFC42.DLL		2510
MFC42.DLL		2542
MFC42.DLL		5243
MFC42.DLL		5740
MFC42.DLL		5290
MFC42.DLL		5577
MFC42.DLL		3172
MFC42.DLL		5653
MFC42.DLL		4420
MFC42.DLL		4953
MFC42.DLL		4858
MFC42.DLL		2399
MFC42.DLL		4387
MFC42.DLL		3454
MFC42.DLL		3198
MFC42.DLL		6080
MFC42.DLL		6175
MFC42.DLL		4623
MFC42.DLL		4426
MFC42.DLL		338
MFC42.DLL		652
MFC42.DLL		4823
MFC42.DLL		4614
MFC42.DLL		4613
MFC42.DLL		1920
MFC42.DLL		4262
MFC42.DLL		4589
MFC42.DLL		4899
MFC42.DLL		5076
MFC42.DLL		4341
MFC42.DLL		4349
MFC42.DLL		4889
MFC42.DLL		4531
MFC42.DLL		4545
MFC42.DLL		4543
MFC42.DLL		4526
MFC42.DLL		4529
MFC42.DLL		4524
MFC42.DLL		4963
MFC42.DLL		4108
MFC42.DLL		5240
MFC42.DLL		3748
MFC42.DLL		1725
MFC42.DLL		4432
MFC42.DLL		784
MFC42.DLL		540
MFC42.DLL		517
MFC42.DLL		800
MFC42.DLL		5260
MFC42.DLL		6157
MFC42.DLL		6131
MFC42.DLL		6216
MFC42.DLL		4723
MFC42.DLL		2535
MFC42.DLL		4464
MFC42.DLL		2864
MFC42.DLL		4960
MFC42.DLL		2652
MFC42.DLL		1669
MFC42.DLL		2086
MFC42.DLL		2379
MFC42.DLL		2859
MFC42.DLL		1842
MFC42.DLL		4242
MFC42.DLL		2723
MFC42.DLL		2390
MFC42.DLL		3059
MFC42.DLL		5100
MFC42.DLL		5103
MFC42.DLL		4467
MFC42.DLL		4303
MFC42.DLL		3350
MFC42.DLL		5012
MFC42.DLL		975
MFC42.DLL		5472
MFC42.DLL		3403
MFC42.DLL		2879
MFC42.DLL		2878
MFC42.DLL		4151
MFC42.DLL		4077
MFC42.DLL		5237
MFC42.DLL		5282
MFC42.DLL		2649
MFC42.DLL		1665
MFC42.DLL		4436
MFC42.DLL		4427
MFC42.DLL		796
MFC42.DLL		674
MFC42.DLL		554
MFC42.DLL		529
MFC42.DLL		366
MFC42.DLL		807
MFC42.DLL		6000
MFC42.DLL		2117
MFC42.DLL		4163
MFC42.DLL		6625
MFC42.DLL		4457
MFC42.DLL		5252
MFC42.DLL		1576
MFC42.DLL		4353
MFC42.DLL		6374
MFC42.DLL		5163
MFC42.DLL		2385
MFC42.DLL		5241
MFC42.DLL		4407
MFC42.DLL		1776
MFC42.DLL		4078
MFC42.DLL		6055
MFC42.DLL		3597
MFC42.DLL		4425
MFC42.DLL		5280
MFC42.DLL		1775
MFC42.DLL		6052
MFC42.DLL		2514
MFC42.DLL		4710
MFC42.DLL		4998
MFC42.DLL		4853
MFC42.DLL		4376
MFC42.DLL		1746
MFC42.DLL		5265
MFC42.DLL		1168
MSVCRT.dll	183		_controlfp
MSVCRT.dll	46		void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCRT.dll	390		_onexit
MSVCRT.dll	85		__dllonexit
MSVCRT.dll	202		_except_handler3
MSVCRT.dll	129		__set_app_type
MSVCRT.dll	111		__p__fmode
MSVCRT.dll	106		__p__commode
MSVCRT.dll	157		_adjust_fdiv
MSVCRT.dll	131		__setusermatherr
MSVCRT.dll	73		__CxxFrameHandler
MSVCRT.dll	426		_setmbcp
MSVCRT.dll	597		floor
MSVCRT.dll	241		_ftol
MSVCRT.dll	211		_exit
MSVCRT.dll	72		_XcptFilter
MSVCRT.dll	585		exit
MSVCRT.dll	143		_acmdln
MSVCRT.dll	88		__getmainargs
MSVCRT.dll	271		_initterm
KERNEL32.dll	273		GetCommandLineW
KERNEL32.dll	383		GetModuleHandleA
KERNEL32.dll	878		UnhandledExceptionFilter
KERNEL32.dll	386		GetModuleHandleW
KERNEL32.dll	439		GetStartupInfoA
KERNEL32.dll	213		FindFirstFileW
KERNEL32.dll	480		GetTimeFormatA
KERNEL32.dll	85		CreateFileMappingW
KERNEL32.dll	581		LCMapStringW
KERNEL32.dll	862		TerminateProcess
KERNEL32.dll	382		GetModuleFileNameW
KERNEL32.dll	86		CreateFileW
USER32.dll	554		ReleaseDC
USER32.dll	403		InvalidateRect
USER32.dll	580		SetCapture
USER32.dll	346		GetSysColor
USER32.dll	268		GetDC
USER32.dll	348		GetSystemMenu
USER32.dll	317		GetMessageTime
USER32.dll	143		DefWindowProcW
USER32.dll	700		UpdateWindow
USER32.dll	571		SendMessageA
USER32.dll	196		EnableWindow
USER32.dll	275		GetDlgItemTextA
GDI32.dll	222		ExtTextOutW
GDI32.dll	215		ExcludeClipRect
GDI32.dll	412		GetPixel
GDI32.dll	586		StretchDIBits
ADVAPI32.dll	466		RegCreateKeyExW
ADVAPI32.dll	503		RegQueryValueExA

show previews

offset	size	type	comment
0	69632	EXE	03/27/2015 11:07:45	#
15c1	15	HTM		#
11000	1510836	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 1580468 bytes (1544 KiB)


--
Type = zip
ERRORS:
Headers Error
Unconfirmed start of archive
WARNINGS:
There are data after the end of archive
Offset = 69632
Physical Size = 156076
Tail Size = 1354760

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2015-03-20 18:02:08 .....       286720       156035  23 ±¸·Ý.exe
------------------- ----- ------------ ------------  ------------------------
2015-03-20 18:02:08             286720       156035  1 files

Warnings: 1

Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62624

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62640

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62656

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62672

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62688

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62704

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62720

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62736

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62752

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62768

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62784

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62800

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 62032

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61526

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61794

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61722

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61624

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61622

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61560

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61522

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61502

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61498

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61686

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61648

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61766

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61516

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61552

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61540

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61514

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61544

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61620

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61518

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61568

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 61480

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 323601

[!] PEdump::IMAGE_RESOURCE_DIRECTORY failed to read entry name: "\x90\xDF" on UTF-16LE

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 147472

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 153616

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 159760

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 196624

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 288784

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 294928

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 301072

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 307216

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 311312

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 315408

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 319504

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 323600

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 327696

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 331792

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 335888

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 339984

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 344080

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 348176

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 352272

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 356368

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 360464

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 364560

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 368656

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 372752

[?] too many errors getting resource data, stopped on 94 of 1536

[!] PEdump::IMAGE_RESOURCE_DIRECTORY: loop3 detected at file pos 372752

[?] too many errors getting resource data, stopped on 106 of 1152

[?] can't find file_offset of VA 0x90

[?] can't find file_offset of VA 0x5339c032

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x3000000

[?] can't find file_offset of VA 0x90008d

[?] can't find file_offset of VA 0x8d8000

[?] can't find file_offset of VA 0x80

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x98000

[?] can't find file_offset of VA 0xb00000

[?] can't find file_offset of VA 0xe128000

[?] can't find file_offset of VA 0x9

[?] can't find file_offset of VA 0x80000150

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x80000168

[?] can't find file_offset of VA 0x1500000

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x800001f8

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x4

[?] can't find file_offset of VA 0xeda24761

[?] can't find file_offset of VA 0x7439f002

[?] can't find file_offset of VA 0x84fe69cd

[?] can't find file_offset of VA 0x213cd690

[?] can't find file_offset of VA 0xb0176ae8

[?] can't find file_offset of VA 0x10ff1cc4

[?] can't find file_offset of VA 0x593a0ec

[?] can't find file_offset of VA 0xcd25bc2e

[?] can't find file_offset of VA 0x5d90ec66

[?] can't find file_offset of VA 0x4e0170e0

[?] can't find file_offset of VA 0xbd1b638

[?] can't find file_offset of VA 0x4e595e56

[?] can't find file_offset of VA 0x6d751367

[?] can't find file_offset of VA 0xc383f1fe

[?] can't find file_offset of VA 0x44662482

[?] can't find file_offset of VA 0xd675e4c8

[?] can't find file_offset of VA 0xdcbdbcd6

[?] can't find file_offset of VA 0x2c5b39e9

[?] can't find file_offset of VA 0x9ddb982e

[?] can't find file_offset of VA 0xb1a9987a

[?] can't find file_offset of VA 0x185ff1e6

[?] can't find file_offset of VA 0x77e0c97f

[?] can't find file_offset of VA 0xaef2e4c8

[?] can't find file_offset of VA 0x25df6330

[?] can't find file_offset of VA 0xba109997

[?] can't find file_offset of VA 0xcc569a9a

[?] can't find file_offset of VA 0x26424820

[?] can't find file_offset of VA 0xb6342e72

[?] can't find file_offset of VA 0x15757e5f

[?] can't find file_offset of VA 0x12b6bb58

[?] can't find file_offset of VA 0x800c3e78

[?] can't find file_offset of VA 0x578a1644

[?] can't find file_offset of VA 0xdeb519db

[?] can't find file_offset of VA 0xd0fce

[?] can't find file_offset of VA 0xd9c7bc2c

[?] can't find file_offset of VA 0x974098da

[?] can't find file_offset of VA 0xa24761ea

[?] can't find file_offset of VA 0x57052db3

[?] can't find file_offset of VA 0xf9902d95

[?] can't find file_offset of VA 0xf4a417a5

[?] can't find file_offset of VA 0xcad3a664

[?] can't find file_offset of VA 0x4cd6bbd1

[?] can't find file_offset of VA 0x1a99fe78

[?] can't find file_offset of VA 0x98dbc0ea

[?] can't find file_offset of VA 0x52a19c02

[?] can't find file_offset of VA 0xd006f11f

[?] can't find file_offset of VA 0xdb0d61c3

[?] can't find file_offset of VA 0x40ea3d50

[?] can't find file_offset of VA 0x303ed920

[!] string size(288) > stringtable size(24). truncated to 22

[?] PEdump::RichHdr: dexored size(92) must be a multiple of 8

[?] can't find file_offset of VA 0x0