火舞BLUE登陆器.exe

info
MZ
PE
resources
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	火舞BLUE登陆器.exe
size	2732270 (0x29b0ee)
md5	2a82c33df0dbdd66d629ea825d47e400

type	PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x110

Rich Header

lib id	version	times used
12	7291	5
11	8047	9
10	8047	6
14	7299	44
19	8022	44
93	2179	2
1	0	683
19	8034	29
11	9782	98
10	9782	217
11	8168	100
10	8168	27
0	0	89
6	1735	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	2
TimeDateStamp	0x591d6694
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x9f000
SizeOfInitializedData	0x64e000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x7f3c2
BaseOfCode	0x1000
BaseOfData	0xa0000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x6f1000
SizeOfHeaders	0x400
CheckSum	0x2725ee
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

PeCompact 2.xx (BitSum Technologies / v2.0)

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x6ed000	0x263c00	RWX CODE
.rsrc	0x6ee000	0x3000	0x2200	RWX CODE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x6ef19c	0x38c
RESOURCE	0x6ee000	0x1092
EXCEPTION	0	0
SECURITY	0	0x34c52
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
TEXTINCLUDE	#1	11
TEXTINCLUDE	#2	22
TEXTINCLUDE	#3	337
CURSOR	#1	308
CURSOR	#2	308
CURSOR	#3	308
CURSOR	#4	180
BITMAP	IEXT_IDB_STATEIMAGES	364
BITMAP	#1031	584
BITMAP	#1038	324
BITMAP	#1138	344
BITMAP	#1139	344
BITMAP	#1140	344
BITMAP	#1141	344
BITMAP	#1142	344
BITMAP	#1143	344
BITMAP	#1144	344
BITMAP	#1145	344
BITMAP	#26567	1508
BITMAP	#30994	184
BITMAP	#30995	364
BITMAP	#30996	324
ICON	#1	744
ICON	#2	296
ICON	#3	744
MENU	#127	12
MENU	#1039	644
DIALOG	#150	152
DIALOG	#286	378
DIALOG	#554	250
DIALOG	#1037	234
DIALOG	#1084	2222
DIALOG	#1124	178
DIALOG	#1134	204
DIALOG	#1150	178
DIALOG	#30721	226
DIALOG	#30722	396
STRING	#3841	80
STRING	#3842	44
STRING	#3843	120
STRING	#3857	452
STRING	#3858	298
STRING	#3859	326
STRING	#3865	64
STRING	#3866	100
STRING	#3867	472
STRING	#3868	276
STRING	#3869	36
GROUP_CURSOR	#1032	20
GROUP_CURSOR	#1033	20
GROUP_CURSOR	#30977	34
GROUP_ICON	DEFAULT_ICON	20
GROUP_ICON	#1151	20
GROUP_ICON	#1152	20
MANIFEST	#1	466

module_name	ord	function_name
kernel32.dll		LoadLibraryA
kernel32.dll		GetProcAddress
kernel32.dll		VirtualAlloc
kernel32.dll		VirtualFree
RASAPI32.dll		RasHangUpA
WINMM.dll		midiStreamOut
WS2_32.dll	9
USER32.dll		GetDlgItem
GDI32.dll		GetTextMetricsA
WINSPOOL.DRV		OpenPrinterA
ADVAPI32.dll		RegCreateKeyExA
SHELL32.dll		ShellExecuteA
ole32.dll		CLSIDFromProgID
OLEAUT32.dll	24
COMCTL32.dll		ImageList_Destroy
WININET.dll		InternetCanonicalizeUrlA
comdlg32.dll		GetSaveFileNameA

show previews

offset	size	type	comment
0	2515456	EXE	05/18/2017 09:17:08	#
15c1	15	HTM		#
266200	216814	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 2732270 bytes (2669 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x6e8000

[?] can't find file_offset of VA 0x6e8010

[?] can't find file_offset of VA 0x6e8028

[?] can't find file_offset of VA 0x6e8180

[?] can't find file_offset of VA 0x6e82b8

[?] can't find file_offset of VA 0x6e83f0

[?] can't find file_offset of VA 0x6e8528

[?] can't find file_offset of VA 0x6e85e0

[?] can't find file_offset of VA 0x6e8750

[?] can't find file_offset of VA 0x6e8998

[?] can't find file_offset of VA 0x6e8ae0

[?] can't find file_offset of VA 0x6e8c38

[?] can't find file_offset of VA 0x6e8d90

[?] can't find file_offset of VA 0x6e8ee8

[?] can't find file_offset of VA 0x6e9040

[?] can't find file_offset of VA 0x6e9198

[?] can't find file_offset of VA 0x6e92f0

[?] can't find file_offset of VA 0x6e9448

[?] can't find file_offset of VA 0x6e95a0

[?] can't find file_offset of VA 0x6e9b88

[?] can't find file_offset of VA 0x6e9c40

[?] can't find file_offset of VA 0x6e9db0

[?] can't find file_offset of VA 0x6e9ef8

[?] can't find file_offset of VA 0x6ea1e0

[?] can't find file_offset of VA 0x6ea308

[?] can't find file_offset of VA 0x6ea318

[?] can't find file_offset of VA 0x6ea5a0

[?] can't find file_offset of VA 0x6ea638

[?] can't find file_offset of VA 0x6ea7b8

[?] can't find file_offset of VA 0x6ea8b8

[?] can't find file_offset of VA 0x6ea9a8

[?] can't find file_offset of VA 0x6eb258

[?] can't find file_offset of VA 0x6eb310

[?] can't find file_offset of VA 0x6eb3e0

[?] can't find file_offset of VA 0x6eb498

[?] can't find file_offset of VA 0x6eb580

[?] can't find file_offset of VA 0x6eb710

[?] can't find file_offset of VA 0x6eb760

[?] can't find file_offset of VA 0x6eb790

[?] can't find file_offset of VA 0x6eb808

[?] can't find file_offset of VA 0x6eb9d0

[?] can't find file_offset of VA 0x6ebb00

[?] can't find file_offset of VA 0x6ebc48

[?] can't find file_offset of VA 0x6ebc88

[?] can't find file_offset of VA 0x6ebcf0

[?] can't find file_offset of VA 0x6ebec8

[?] can't find file_offset of VA 0x6ebfe0

[?] can't find file_offset of VA 0x6ec008

[?] can't find file_offset of VA 0x6ec020

[?] can't find file_offset of VA 0x6ec038

[?] can't find file_offset of VA 0x6ec060

[?] can't find file_offset of VA 0x6ec078