renpy.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	renpy.exe
size	133452 (0x2094c)
md5	1099defda08fe30b86ded871f8684db7

type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x80

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x58942445
PointerToSymbolTable	0x19c00
NumberOfSymbols	0x4e5
SizeOfOptionalHeader	0xe0
Characteristics	0x307
Magic	0x10b
LinkerVersion	2.23
SizeOfCode	0x2000
SizeOfInitializedData	0x19800
SizeOfUninitializedData	0x400
AddressOfEntryPoint	0x14c0
BaseOfCode	0x1000
BaseOfData	0x3000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	1.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x20000
SizeOfHeaders	0x400
CheckSum	0x2cb49
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x1f74	0x2000	R-X CODE IDATA
.data	0x3000	0x28	0x200	RW- IDATA
.rdata	0x4000	0x550	0x600	R-- IDATA
.bss	0x5000	0x3f0	0	RW- UDATA
.idata	0x6000	0x864	0xa00	RW- IDATA
.CRT	0x7000	0x34	0x200	RW- IDATA
.tls	0x8000	0x20	0x200	RW- IDATA
.rsrc	0x9000	0x160a4	0x16200	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x6000	0x864
RESOURCE	0x9000	0x160a4
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x8000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x618c	0x128
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x408018	0x40801c	0x405030	0x407020	0	0

show previews

type	name	size
ICON	#1	73484
ICON	#2	9640
ICON	#3	4264
ICON	#4	1128
GROUP_ICON	#0	62
MANIFEST	#1	642

module_name	hint	function_name
SDL2.dll	441	SDL_ShowSimpleMessageBox
KERNEL32.dll	212	DeleteCriticalSection
KERNEL32.dll	239	EnterCriticalSection
KERNEL32.dll	452	GetCurrentProcess
KERNEL32.dll	453	GetCurrentProcessId
KERNEL32.dll	457	GetCurrentThreadId
KERNEL32.dll	505	GetFullPathNameA
KERNEL32.dll	515	GetLastError
KERNEL32.dll	533	GetModuleHandleA
KERNEL32.dll	581	GetProcAddress
KERNEL32.dll	612	GetStartupInfoA
KERNEL32.dll	635	GetSystemTimeAsFileTime
KERNEL32.dll	663	GetTickCount
KERNEL32.dll	747	InitializeCriticalSection
KERNEL32.dll	806	LeaveCriticalSection
KERNEL32.dll	915	QueryPerformanceCounter
KERNEL32.dll	1127	SetUnhandledExceptionFilter
KERNEL32.dll	1140	Sleep
KERNEL32.dll	1154	TerminateProcess
KERNEL32.dll	1161	TlsGetValue
KERNEL32.dll	1174	UnhandledExceptionFilter
KERNEL32.dll	1206	VirtualProtect
KERNEL32.dll	1209	VirtualQuery
msvcr90.dll	141	__argc
msvcr90.dll	142	__argv
msvcr90.dll	154	__dllonexit
msvcr90.dll	163	__getmainargs
msvcr90.dll	164	__initenv
msvcr90.dll	176	__lconv_init
msvcr90.dll	228	__set_app_type
msvcr90.dll	231	__setusermatherr
msvcr90.dll	257	_acmdln
msvcr90.dll	281	_amsg_exit
msvcr90.dll	304	_cexit
msvcr90.dll	411	_fmode
msvcr90.dll	520	_initterm
msvcr90.dll	528	_iob
msvcr90.dll	633	_lock
msvcr90.dll	805	_onexit
msvcr90.dll	868	_set_invalid_parameter_handler
msvcr90.dll	882	_snprintf
msvcr90.dll	1004	_unlock
msvcr90.dll	1040	_vsnprintf
msvcr90.dll	1211	abort
msvcr90.dll	1226	calloc
msvcr90.dll	1234	exit
msvcr90.dll	1248	fopen
msvcr90.dll	1250	fprintf
msvcr90.dll	1258	free
msvcr90.dll	1269	fwrite
msvcr90.dll	1312	malloc
msvcr90.dll	1318	mbstowcs
msvcr90.dll	1323	memcpy
msvcr90.dll	1343	realloc
msvcr90.dll	1350	setlocale
msvcr90.dll	1352	signal
msvcr90.dll	1364	strcmp
msvcr90.dll	1372	strlen
msvcr90.dll	1375	strncmp
msvcr90.dll	1405	vfprintf
msvcr90.dll	1444	wcstombs
msvcr90.dll	1510	_strdup
python27.dll	196	PyEval_InitThreads
python27.dll	582	PyRun_SimpleFileExFlags
python27.dll	584	PyRun_SimpleStringFlags
python27.dll	661	PySys_SetArgvEx
python27.dll	852	Py_IgnoreEnvironmentFlag
python27.dll	855	Py_Initialize
python27.dll	865	Py_OptimizeFlag
python27.dll	869	Py_SetProgramName

show previews

offset	size	type	comment
0	105472	EXE	02/03/2017 06:33:41	#
15c1	15	HTM		#
3b78	73484	PNG	(256 x 256)	#
19c00	27980	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0x5030