filenameRayman2Demo.exe
size1399808 (0x155c00)
md525ff86bc9faf6749c7af04203e07902a
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xb0

Rich Header

lib idversiontimes used
00485
2730397

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x37bad080
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10e
Magic0x10b
LinkerVersion5.10
SizeOfCode0x107600
SizeOfInitializedData0x1f5000
SizeOfUninitializedData0
AddressOfEntryPoint0xbe000
BaseOfCode0x1000
BaseOfData0x109000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x300000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++

Sections

namevavsizeraw sizeflags
.text0x10000x1074360x107600R-X CODE
.rdata0x1090000x2f0c0x3000R-- IDATA
.data0x10c0000x1e054c0x24600RW- IDATA
.idata0x2ed0000x13460x1400RW- IDATA
.reloc0x2ef0000x105000x10600R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x10a0700x1e9c
IMPORT0x2ed0000xb4
RESOURCE00
EXCEPTION00
SECURITY00
BASERELOC0x2ef0000xf20c
DEBUG0x1090000x54
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x2ed4040x350
Delay_IAT00
CLR_Header00
module_namehintordfunction_name
USER32.dll545SetWindowTextA
USER32.dll374LoadIconA
USER32.dll228GetClientRect
USER32.dll128DefWindowProcA
USER32.dll435PostQuitMessage
USER32.dll593UpdateWindow
USER32.dll370LoadCursorA
USER32.dll474SendMessageA
USER32.dll356IsIconic
USER32.dll144DispatchMessageA
USER32.dll433PostMessageA
USER32.dll405MessageBoxA
USER32.dll446RegisterClassA
USER32.dll300GetSystemMetrics
USER32.dll85CreateWindowExA
USER32.dll557ShowWindow
USER32.dll277GetMessageA
USER32.dll581TranslateMessage
USER32.dll553ShowCursor
USER32.dll571ToAsciiEx
USER32.dll397MapVirtualKeyExA
USER32.dll461ReleaseDC
USER32.dll238GetDC
USER32.dll378LoadKeyboardLayoutA
USER32.dll257GetKeyState
USER32.dll260GetKeyboardLayoutNameA
GDI32.dll199GetDeviceCaps
MSVCRT.dll88__getmainargs
MSVCRT.dll155_adjust_fdiv
MSVCRT.dll130__setusermatherr
MSVCRT.dll96__mb_cur_max
MSVCRT.dll180_controlfp
MSVCRT.dll85__dllonexit
MSVCRT.dll387_onexit
MSVCRT.dll268_initterm
MSVCRT.dll208_exit
MSVCRT.dll141_acmdln
MSVCRT.dll72_XcptFilter
MSVCRT.dll594floor
MSVCRT.dll446_stricmp
MSVCRT.dll664modf
MSVCRT.dll673qsort
MSVCRT.dll667printf
MSVCRT.dll239_fullpath
MSVCRT.dll274_isctype
MSVCRT.dll729vsprintf
MSVCRT.dll438_splitpath
MSVCRT.dll128__set_app_type
MSVCRT.dll395_pctype
MSVCRT.dll406_rmdir
MSVCRT.dll421_setjmp3
MSVCRT.dll653longjmp
MSVCRT.dll689srand
MSVCRT.dll675rand
MSVCRT.dll661memmove
MSVCRT.dll676realloc
MSVCRT.dll59_CIpow
MSVCRT.dll49_CIacos
MSVCRT.dll704strrchr
MSVCRT.dll714system
MSVCRT.dll710strtoul
MSVCRT.dll591fgets
MSVCRT.dll701strncmp
MSVCRT.dll700strncat
MSVCRT.dll720tolower
MSVCRT.dll571atol
MSVCRT.dll602fread
MSVCRT.dll611fwrite
MSVCRT.dll238_ftol
MSVCRT.dll702strncpy
MSVCRT.dll690sscanf
MSVCRT.dll692strchr
MSVCRT.dll569atof
MSVCRT.dll708strtok
MSVCRT.dll140_access
MSVCRT.dll570atoi
MSVCRT.dll717time
MSVCRT.dll650localtime
MSVCRT.dll677remove
MSVCRT.dll582exit
MSVCRT.dll687sprintf
MSVCRT.dll596fopen
MSVCRT.dll597fprintf
MSVCRT.dll585fclose
MSVCRT.dll706strstr
MSVCRT.dll603free
MSVCRT.dll654malloc
MSVCRT.dll199_except_handler3
MSVCRT.dll105__p__commode
MSVCRT.dll110__p__fmode
MSVCRT.dll221_findfirst
MSVCRT.dll383_mkdir
MSVCRT.dll170_chdir
MSVCRT.dll220_findclose
MSVCRT.dll679rewind
MSVCRT.dll223_findnext
MSVCRT.dll439_stat
MSVCRT.dll573calloc
MSVCRT.dll609ftell
MSVCRT.dll217_filelength
MSVCRT.dll246_getcwd
MSVCRT.dll176_close
MSVCRT.dll226_flsbuf
MSVCRT.dll215_filbuf
MSVCRT.dll678rename
MSVCRT.dll607fseek
MSVCRT.dll589fgetc
MSVCRT.dll305_itoa
MSVCRT.dll442_strcmpi
MSVCRT.dll456_strupr
MSVCRT.dll321_lseek
MSVCRT.dll196_eof
MSVCRT.dll460_tell
MSVCRT.dll721toupper
MSVCRT.dll450_strnicmp
MSVCRT.dll388_open
MSVCRT.dll532_write
MSVCRT.dll405_read
MSVCRT.dll474_unlink
MSVCRT.dll173_chmod
MSVCRT.dll448_strlwr
KERNEL32.dll42CreateDirectoryA
KERNEL32.dll209GetCurrentDirectoryA
KERNEL32.dll639WritePrivateProfileStringA
KERNEL32.dll577SuspendThread
KERNEL32.dll214GetCurrentThreadId
KERNEL32.dll4AllocConsole
KERNEL32.dll298GetStdHandle
KERNEL32.dll519SetConsoleScreenBufferSize
KERNEL32.dll523SetConsoleWindowInfo
KERNEL32.dll521SetConsoleTitleA
KERNEL32.dll477ReleaseMutex
KERNEL32.dll624WriteConsoleA
KERNEL32.dll223GetDriveTypeA
KERNEL32.dll335GetVolumeInformationA
KERNEL32.dll248GetLogicalDriveStringsA
KERNEL32.dll317GetTempPathA
KERNEL32.dll296GetStartupInfoA
KERNEL32.dll410LocalFree
KERNEL32.dll524SetCurrentDirectoryA
KERNEL32.dll72DebugBreak
KERNEL32.dll142FlushFileBuffers
KERNEL32.dll537SetFilePointer
KERNEL32.dll470ReadFile
KERNEL32.dll635WriteFile
KERNEL32.dll232GetFileAttributesA
KERNEL32.dll535SetFileAttributesA
KERNEL32.dll325GetTickCount
KERNEL32.dll76DeleteCriticalSection
KERNEL32.dll377InitializeCriticalSection
KERNEL32.dll88EnterCriticalSection
KERNEL32.dll399LeaveCriticalSection
KERNEL32.dll348GlobalFree
KERNEL32.dll341GlobalAlloc
KERNEL32.dll152FreeLibrary
KERNEL32.dll400LoadLibraryA
KERNEL32.dll278GetProcAddress
KERNEL32.dll61CreateProcessA
KERNEL32.dll230GetExitCodeProcess
KERNEL32.dll49CreateFileA
KERNEL32.dll237GetFileSize
KERNEL32.dll479RemoveDirectoryA
KERNEL32.dll130FindFirstFileA
KERNEL32.dll37CopyFileA
KERNEL32.dll135FindNextFileA
KERNEL32.dll126FindClose
KERNEL32.dll422MoveFileA
KERNEL32.dll442OutputDebugStringA
KERNEL32.dll78DeleteFileA
KERNEL32.dll333GetVersionExA
KERNEL32.dll454QueryPerformanceFrequency
KERNEL32.dll274GetPrivateProfileStringA
KERNEL32.dll337GetWindowsDirectoryA
KERNEL32.dll453QueryPerformanceCounter
KERNEL32.dll56CreateMutexA
KERNEL32.dll244GetLastError
KERNEL32.dll478ReleaseSemaphore
KERNEL32.dll449PulseEvent
KERNEL32.dll254GetModuleHandleA
KERNEL32.dll583TerminateThread
KERNEL32.dll67CreateThread
KERNEL32.dll482ResumeThread
KERNEL32.dll24CloseHandle
KERNEL32.dll64CreateSemaphoreA
KERNEL32.dll548SetPriorityClass
KERNEL32.dll616WaitForMultipleObjects
KERNEL32.dll429OpenEventA
KERNEL32.dll46CreateEventA
KERNEL32.dll618WaitForSingleObject
KERNEL32.dll532SetEvent
KERNEL32.dll481ResetEvent
KERNEL32.dll252GetModuleFileNameA
KERNEL32.dll147FormatMessageA
KERNEL32.dll575Sleep
DDRAW.dll5DirectDrawCreate
WINMM.dll152timeKillEvent
WINMM.dll148timeEndPeriod
WINMM.dll151timeGetTime
WINMM.dll147timeBeginPeriod
WINMM.dll149timeGetDevCaps
WINMM.dll153timeSetEvent
WINMM.dll172waveOutGetDevCapsA
SHELL32.dll97ShellExecuteA
DINPUT.dllDirectInputCreateA
ordentry_vafunction_name
10x101d00INO_fn_hCreateDevice
20x101ba0INO_fn_hGetRandomHandle
30x101c40INO_fn_ulGetMonkeyValue
40x103300INO_fn_ulJoyPreviousButtons
50x1032d0INO_fn_uwJoyPreviousDirections
60x101bb0INO_fn_vActiveMonkey
70x101bf0INO_fn_vMonkeyForJoystick
80x101c10INO_fn_vMonkeyForKeyboard
90x101bd0INO_fn_vMonkeyForMouse
100x101cc0INO_fn_vRelease
110x102060INO_fn_vResetDevice
120x101c30INO_fn_vSetMonkeyValue
130x1021d0INO_fn_wActivateDevice
140x102210INO_fn_wDeactivateDevice
150x102690INO_fn_wGetNbDevices
160x101c60INO_fn_wInit
170x102150INO_fn_wInvalidateHandle
180x1028a0INO_fn_wIsConnected
190x102110INO_fn_wIsHandleValid
200x102160INO_fn_wReadAllDevices
210x101f90INO_fn_wReleaseDevice
220x5d6c0IPT_PrintUsedStaticMemory
230x5d8b0IPT_fn_bChangeIPTValue
240x5d610IPT_fn_bGetActivationFlagOfEntryElement
250x5d530IPT_fn_bIsAValidEntryActionHandle
260x61f00IPT_fn_bIsCommandValid
270x62400IPT_fn_bIsEmptyHistoricElement
280x5df40IPT_fn_bIsInvalidated
290x5d720IPT_fn_bIsJoystickControlAvailable
300x5df20IPT_fn_bIsJustInvalidated
310x5dee0IPT_fn_bIsJustValidated
320x5d6f0IPT_fn_bIsKeyboardControlAvailable
330x62420IPT_fn_bIsKeyboardHistoricElement
340x62440IPT_fn_bIsPadHistoricElement
350x5d700IPT_fn_bIsPaddleControlAvailable
360x5df00IPT_fn_bIsValidated
370x5d870IPT_fn_bModifyIPTAction
380x5d690IPT_fn_cGetValidAsciiKey
390x61b00IPT_fn_cReadCommand
400x62080IPT_fn_cSearchCommandInCommandList
410x5db40IPT_fn_hAllocKeyWord
420x5d620IPT_fn_hGetCommandHandle
430x5e540IPT_fn_hGetEntryActionHandle
440x5d4d0IPT_fn_hGetEntryActionHandleForOptions
450x5df60IPT_fn_lHowManyFrame
460x5fc70IPT_fn_p_szGetKeyPointerOfName
470x5db80IPT_fn_p_szGetNameOfKeyName
480x5fcd0IPT_fn_swConvertAZERTYtoQWERTY
490x5fb30IPT_fn_swGetKeyValue
500x61f20IPT_fn_szCommandLineAction
510x61f30IPT_fn_szCommandLineAllParameters
520x61f40IPT_fn_szCommandLineAllParametersFrom
530x61f70IPT_fn_szCommandLineParameter
540x5d570IPT_fn_szEntryActionNumber
550x622f0IPT_fn_szFindNextCommandInHistoric
560x62290IPT_fn_szFindPreviousCommandInHistoric
570x5d680IPT_fn_szGetCommandActionName
580x61da0IPT_fn_szGetCommandLine
590x5d520IPT_fn_szGetEntryActionName
600x61d90IPT_fn_szGetInternalCommandLine
610x5fbe0IPT_fn_szGetKeyName
620x5dae0IPT_fn_szGetStringOf
630x61f90IPT_fn_ucCommandLineNumberOfParameters
640x623a0IPT_fn_ulGetNumberOfCommand
650x5db60IPT_fn_ulGetNumberOfKeyAndPadDefine
660x5df80IPT_fn_ulHowManyAbsoluteFrame
670x5d560IPT_fn_ulNumberOfEntryAction
680x623f0IPT_fn_ulSizeOfHistoric
690x5d5a0IPT_fn_vActivateAllEntryElements
700x5d5d0IPT_fn_vActivateEntryElement
710x5d780IPT_fn_vActiveJoystickControl
720x5d7c0IPT_fn_vActivePaddleControl
730x62220IPT_fn_vAddCommandLineInHistoric
740x61fa0IPT_fn_vCleanString
750x5e1b0IPT_fn_vComputeArrayFromList
760x5d3c0IPT_fn_vCreateMouseDevice
770x61db0IPT_fn_vDecomposeCommandLine
780x5d5f0IPT_fn_vDesactivateEntryElement
790x5d740IPT_fn_vDesactiveJoystickAndPadControl
800x5d410IPT_fn_vDesinitInput
810x5d330IPT_fn_vDesinitInputWhenLoadSnapshot
820x5e1a0IPT_fn_vEndReadInputScript
830x5d010IPT_fn_vFirstInitInput
840x623b0IPT_fn_vGetCommandeSyntaxe
850x61d40IPT_fn_vInitCommandLines
860x61d80IPT_fn_vInitCommandLinesSwapper
870x5d0c0IPT_fn_vInitInput
880x5d280IPT_fn_vInitInputWhenLoadSnapshot
890x5d080IPT_fn_vInitMemory
900x5dda0IPT_fn_vReadInput
910x5e190IPT_fn_vReadInputScript
920x5d4a0IPT_fn_vResetInputEntry
930x62110IPT_fn_vSearchValidCommandByLetters
940x5dfa0IPT_fn_xGetAnalogicValue
950xa2f00SND_PrintUsedStaticMemory
960xb2a10_SND_fn_bCanSetOptions@0
970xac070_SND_fn_bEndLoadBanks@0
980xac660_SND_fn_bEnterCriticalSectionForDriverThreadSnd@0
990xab600_SND_fn_bGetCurrentDirectory@8
1000xab430_SND_fn_bGetOneDataDirectory@12
1010xb2970_SND_fn_bGetOptions@16
1020xac000_SND_fn_bInitBank2@8
1030xabff0_SND_fn_bInitBank@4
1040xaac00SND_fn_bInitDataLoadSnd
1050xab4e0_SND_fn_bIsDataDirectory@4
1060xac100_SND_fn_bLoadBinaryBank@4
1070xab6a0_SND_fn_bLoadDataInMem@16
1080xab620_SND_fn_bLoadDataInMemAndSwap@20
1090xab5f0_SND_fn_bSetCurrentDirectory@4
1100xabfa0_SND_fn_bStartLoadBanks2@4
1110xabf90_SND_fn_bStartLoadBanks@0
1120xb4cf0_SND_fn_bTestSnd_MMX@0
1130xb4cd0_SND_fn_bTestSnd_Pentium@0
1140xb4e00_SND_fn_bTestSnd_Win32@0
1150xb4d30_SND_fn_bTestSnd_WinMM@4
1160xb4e40_SND_fn_bTestSnd_WinNT@0
1170xac4a0_SND_fn_bTryToEnterCriticalSectionThreadSnd@0
1180xac180_SND_fn_bUnLoadBinaryBank@4
1190xac810_SND_fn_czGetResNameFromEdId@4
1200xab6c0_SND_fn_dwFileSndLength@4
1210xab7d0_SND_fn_dwReadFileSnd@12
1220xab840_SND_fn_dwSeekFileSnd@12
1230xab810_SND_fn_dwWriteFileSnd@12
1240xab6d0_SND_fn_hOpenFileReadSnd@4
1250xa31f0_SND_fn_iErreurInit@4
1260xab480_SND_fn_iGetIdDataDirectory@4
1270xabec0_SND_fn_iGetNumberOfBanks@0
1280xab470_SND_fn_iGetNumberOfDataDirectory@0
1290xabed0_SND_fn_iGetNumberOfEventInBank@4
1300xaa590_SND_fn_pGetBinEvent@4
1310xabf40_SND_fn_pGetBinRes@4
1320xa2ae0_SND_fn_pvMallocSnd@4
1330xa2b80_SND_fn_pvMallocSndEx@8
1340xa2c30_SND_fn_pvReAllocSnd@8
1350xa2cd0_SND_fn_pvReAllocSndEx@12
1360xb1cc0_SND_fn_rAbsRealSnd@4
1370xb1ca0_SND_fn_rDivRealRealSnd@8
1380xb3480_SND_fn_rDopplerPitch@16
1390xb3550_SND_fn_rGetDopplerFactor@0
1400xb1be0_SND_fn_rMulRealRealQuickSnd@8
1410xb1b10_SND_fn_rMulRealRealSnd@8
1420xb4ad0_SND_fn_rNormeVectorSnd@4
1430xb1cd0_SND_fn_rPseudoNormeRealSnd@12
1440xb4b30_SND_fn_rPseudoNormeVectorSnd@4
1450xb4bb0_SND_fn_rPseudoScalaireNormeVectorSnd@8
1460xb4b70_SND_fn_rScalaireVectorSnd@8
1470xb1c00_SND_fn_rSqrtRealSnd@4
1480xb1d30_SND_fn_rtSndRealToSndRealTwin@8
1490xab330_SND_fn_szGetSoftDirectory@0
1500xb3390_SND_fn_ucDistanceToVolume@4
1510xb33e0_SND_fn_ucDistanceToVolumeEx@8
1520xb3630_SND_fn_ucPositionToDolby@12
1530xb3570_SND_fn_ucPositionToPan@16
1540xab340_SND_fn_vAddDataDirectory@4
1550xab860_SND_fn_vCloseFileSnd@4
1560xabf10_SND_fn_vDesInitBankSnd@0
1570xa3020_SND_fn_vDesInitErrorSnd@0
1580xa2a60_SND_fn_vDesInitMallocSnd@0
1590xac370_SND_fn_vDesInitThreadSnd@0
1600xa2f20_SND_fn_vDisplayError@8
1610xa2f80_SND_fn_vDisplayErrorEx@12
1620xac610_SND_fn_vEnterCriticalSectionForErrorDisplay@0
1630xac400_SND_fn_vEnterCriticalSectionThreadSnd_@0
1640xa2d80_SND_fn_vFreeSnd@4
1650xa2e20_SND_fn_vFreeSndEx@8
1660xb3370_SND_fn_vGetDefaultRollOff@4
1670xb1db0_SND_fn_vGetHModuleAdpcm@0
1680xb1da0_SND_fn_vGetHModuleCd@0
1690xb1d70_SND_fn_vGetHModuleDbg@0
1700xb1d80_SND_fn_vGetHModuleMpeg@0
1710xb1dc0_SND_fn_vGetHModuleRecord@0
1720xb1d90_SND_fn_vGetHModuleWav@0
1730xabef0_SND_fn_vInitBankSnd@4
1740xa2fa0_SND_fn_vInitErrorSnd@4
1750xa2980_SND_fn_vInitMallocSnd@0
1760xac330_SND_fn_vInitThreadSnd@0
1770xac3a0_SND_fn_vMouchardThreadsnd@8
1780xb4bf0_SND_fn_vProduitVectorSnd@12
1790xab420_SND_fn_vPurgeDataDirectory@0
1800xac640_SND_fn_vQuitCriticalSectionForErrorDisplay@0
1810xac550_SND_fn_vQuitCriticalSectionThreadSnd@0
1820xab3b0_SND_fn_vRemoveDataDirectory@4
1830xa2ed0_SND_fn_vResizeMemoryBlockSnd@8
1840xab500_SND_fn_vResolveFileName@8
1850xb3350_SND_fn_vSetDefaultRollOff@4
1860xb3520_SND_fn_vSetDopplerFactor@4
1870xb29f0_SND_fn_vSetOptions@12
1880xac800_SND_fn_vSetResNameCallback@4
1890xab300_SND_fn_vSetSoftDirectory@4
1900xb1d00_SND_fn_vSndRealTwinToSndReal@12
1910xac570_SND_fn_vWaitForValueThreadSnd@8
1920xa30a0__snd_assert@12
1930xac750_dbgSND_fn_bGetAskedTheme@8
1940xac770_dbgSND_fn_bGetThemePosition@12
1950xac830_dbgSND_fn_bSetResourceStaticVolume@8
1960xac7b0_dbgSND_fn_lGetSizeOfSoundParam@4
1970xac860_dbgSND_fn_rGetDopplerFactor@0
1980xac790_dbgSND_fn_vGetInfoForObjectSound@16
1990xac870_dbgSND_fn_vSendRequestSound@4
2000x2e0200g_a_stSndBlocksInfo
2010x11b860g_a_stSndTabErr
2020x1130f8g_a_szIPTInformationModule
2030x11b850g_a_szSndInformationModule
2040x11b85cg_szSndModuleName
2050x11b848g_ucSndModuleId
2060x1477dcgcSimulateNotU64
2070x12fd7cgcSimulateRelease
2080xa3180_snd_erreur_init@4
module_nameMainWinR.exe
flags0
timestamp1999-08-18 15:25:52
version0.0
ordinal_base1
nFunctions208
nNames208
Names(208)0x10a3d8
Functions(208)0x10a098
NameOrdinals(208)0x10a718
offsetsizetypecomment
01313280EXE08/18/1999 15:25:52#
15c115HTM#
140a0086528BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK