filenameOpenOSRS.exe
size403968 (0x62a00)
md535117f30da28530f826f1f0cf2cbb121
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x118

Rich Header

lib idversiontimes used
2592571113
26125711178
2602571122
199411182
2592613121
2612613162
2602613133
257257113
1092
260264333
261264332
256264331
255264331
258264331

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x5b50f2a4
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x122
Magic0x10b
LinkerVersion14.14
SizeOfCode0x31200
SizeOfInitializedData0x32400
SizeOfUninitializedData0
AddressOfEntryPoint0x10b6f
BaseOfCode0x1000
BaseOfData0x33000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x67000
SizeOfHeaders0x400
CheckSum0x63355
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x4c4b40
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x310320x31200R-X CODE
.rdata0x330000x112040x11400R-- IDATA
.data0x450000x28ac0x1a00RW- IDATA
.rsrc0x480000x1b8900x1ba00R-- IDATA
.reloc0x640000x2a0c0x2c00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x43a500x80
IMPORT0x43ad00x28
RESOURCE0x480000x1b890
EXCEPTION00
SECURITY00
BASERELOC0x640000x2a0c
DEBUG0x412b00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x412d00x40
Bound_IAT00
IAT0x330000x144
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#1115640
ICON#2676240
ICON#3169360
ICON#496400
ICON#542640
ICON#611280
GROUP_ICONMAINICON900
MANIFEST#110440
module_namehintordfunction_name
KERNEL32.dll605GetLastError
KERNEL32.dll682GetProcAddress
KERNEL32.dll956LoadLibraryA
KERNEL32.dll969LocalFree
KERNEL32.dll420FormatMessageA
KERNEL32.dll21AllocConsole
KERNEL32.dll422FreeConsole
KERNEL32.dll1545WriteConsoleW
KERNEL32.dll1526WideCharToMultiByte
KERNEL32.dll303EnterCriticalSection
KERNEL32.dll952LeaveCriticalSection
KERNEL32.dll270DeleteCriticalSection
KERNEL32.dll1000MultiByteToWideChar
KERNEL32.dll299EncodePointer
KERNEL32.dll263DecodePointer
KERNEL32.dll1322SetLastError
KERNEL32.dll858InitializeCriticalSectionAndSpinCount
KERNEL32.dll1407SwitchToThread
KERNEL32.dll1430TlsAlloc
KERNEL32.dll1432TlsGetValue
KERNEL32.dll1433TlsSetValue
KERNEL32.dll1431TlsFree
KERNEL32.dll741GetSystemTimeAsFileTime
KERNEL32.dll628GetModuleHandleW
KERNEL32.dll940LCMapStringW
KERNEL32.dll609GetLocaleInfoW
KERNEL32.dll723GetStringTypeW
KERNEL32.dll447GetCPInfo
KERNEL32.dll897IsProcessorFeaturePresent
KERNEL32.dll890IsDebuggerPresent
KERNEL32.dll1445UnhandledExceptionFilter
KERNEL32.dll1381SetUnhandledExceptionFilter
KERNEL32.dll716GetStartupInfoW
KERNEL32.dll533GetCurrentProcess
KERNEL32.dll1412TerminateProcess
KERNEL32.dll1094QueryPerformanceCounter
KERNEL32.dll534GetCurrentProcessId
KERNEL32.dll538GetCurrentThreadId
KERNEL32.dll862InitializeSListHead
KERNEL32.dll1115RaiseException
KERNEL32.dll1227RtlUnwind
KERNEL32.dll425FreeLibrary
KERNEL32.dll958LoadLibraryExW
KERNEL32.dll348ExitProcess
KERNEL32.dll627GetModuleHandleExW
KERNEL32.dll468GetCommandLineA
KERNEL32.dll469GetCommandLineW
KERNEL32.dll1292SetEnvironmentVariableW
KERNEL32.dll1281SetCurrentDirectoryW
KERNEL32.dll527GetCurrentDirectoryW
KERNEL32.dll624GetModuleFileNameW
KERNEL32.dll718GetStdHandle
KERNEL32.dll1546WriteFile
KERNEL32.dll833HeapAlloc
KERNEL32.dll837HeapFree
KERNEL32.dll904IsValidLocale
KERNEL32.dll782GetUserDefaultLCID
KERNEL32.dll338EnumSystemLocalesW
KERNEL32.dll586GetFileType
KERNEL32.dll134CloseHandle
KERNEL32.dll413FlushFileBuffers
KERNEL32.dll488GetConsoleCP
KERNEL32.dll506GetConsoleMode
KERNEL32.dll1132ReadFile
KERNEL32.dll1307SetFilePointerEx
KERNEL32.dll840HeapReAlloc
KERNEL32.dll371FindClose
KERNEL32.dll377FindFirstFileExW
KERNEL32.dll394FindNextFileW
KERNEL32.dll902IsValidCodePage
KERNEL32.dll432GetACP
KERNEL32.dll659GetOEMCP
KERNEL32.dll563GetEnvironmentStringsW
KERNEL32.dll424FreeEnvironmentStringsW
KERNEL32.dll688GetProcessHeap
KERNEL32.dll1346SetStdHandle
KERNEL32.dll1129ReadConsoleW
KERNEL32.dll202CreateFileW
KERNEL32.dll842HeapSize
KERNEL32.dll1288SetEndOfFile
ordentry_vafunction_name
10x4504cAmdPowerXpressRequestHighPerformance
20x45048NvOptimusEnablement
module_namepackr.exe
flags0
timestamp2106-02-07 06:28:15
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x43a80
Functions(2)0x43a78
NameOrdinals(2)0x43a88
offsetsizetypecomment
0403968EXE07/19/2018 20:20:52#
15c115HTM#
445ec11564PNG(256 x 256)#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER