Amazon.exe

info
MZ
PE
resources
imports
exports
foremost
hexdump
disasm
log
discuss
donate

filename	Amazon.exe
size	5061632 (0x4d3c00)
md5	46c3c78d861bb725dd2877f94439b205

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x148

Rich Header

lib id	version	times used
11	9782	3
96	3077	1
171	40219	36
150	20413	12
149	30729	67
109	50727	1
132	21022	254
132	30729	348
156	40219	12
156	30319	4
171	30319	1
131	30729	276
156	21202	2
123	50727	31
147	30729	8
1	0	601
138	30729	343
146	30729	1
148	21022	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x5364df43
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x122
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x696e00
SizeOfInitializedData	0x251000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x121893
BaseOfCode	0x1000
BaseOfData	0x698000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x14f6000
SizeOfHeaders	0x400
CheckSum	0x8f0cda
Subsystem	2
DllCharacteristics	0x8040
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Borland Delphi v3.0

Sections

name	va	vsize	raw size	flags
	0x1000	0x697000	0x285000	RWX IDATA
	0x698000	0x158000	0x8b200	RWX IDATA
	0x7f0000	0x7fe000	0xd600	RWX IDATA
	0xfee000	0x1000	0	RWX IDATA
	0xfef000	0x5b000	0x200	RWX IDATA
	0x104a000	0x6a000	0	RWX IDATA
.rsrc	0x10b4000	0x5b000	0x5aa00	RWX IDATA
	0x110f000	0x2b5000	0x29a00	RWX IDATA
.data	0x13c4000	0x132000	0x131a00	RWX IDATA

Data Directory

type	va	size
EXPORT	0x13c4048	0x493
IMPORT	0x13c44dc	0x6fc
RESOURCE	0x10b4000	0x5a8c0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x13c4028	0x10
DEBUG	0x69d440	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x13c4000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x13ee000	0x13ee008	0x17c4018	0x17c4020	0	0

show previews

type	name	size	cp
ICON	#1	1128	1252
ICON	#2	4264	1252
ICON	#3	9640	1252
ICON	#4	16936	1252
ICON	#5	67624	1252
ICON	#6	270376	1252
GROUP_ICON	#1005	90	1252
MANIFEST	#1	346	1252

module_name	ord	function_name
kernel32.dll		GetModuleHandleA
kernel32.dll		GetProcAddress
kernel32.dll		ExitProcess
kernel32.dll		LoadLibraryA
user32.dll		MessageBoxA
advapi32.dll		RegCloseKey
oleaut32.dll		SysFreeString
gdi32.dll		CreateFontA
shell32.dll		ShellExecuteA
version.dll		GetFileVersionInfoA
winmm.dll		timeGetTime
ws2_32.dll	23
d3dx9_43.dll		D3DXSaveSurfaceToFileA
d3d9.dll		D3DPERF_BeginEvent
iphlpapi.dll		IcmpCloseHandle
fmodex.dll		public: enum FMOD_RESULT __stdcall FMOD::System::setOutput(enum FMOD_OUTPUTTYPE) ?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
fmod_event.dll		public: enum FMOD_RESULT __stdcall FMOD::EventSystem::get3DListenerAttributes(int, struct FMOD_VECTOR , struct FMOD_VECTOR , struct FMOD_VECTOR , struct FMOD_VECTOR ) ?get3DListenerAttributes@EventSystem@FMOD@@QAG?AW4FMOD_RESULT@@HPAUFMOD_VECTOR@@000@Z
fmod_event_net.dll		enum FMOD_RESULT __stdcall FMOD::NetEventSystem_Update(void) ?NetEventSystem_Update@FMOD@@YG?AW4FMOD_RESULT@@XZ
crypt32.dll		CryptDecodeObject
ts3client_win32.dll		ts3client_setClientSelfVariableAsInt
vmprotectsdk32.dll		VMProtectBeginMutation
psapi.dll		EnumProcessModules
physx3_x86.dll		public: __thiscall physx::PxCapsuleGeometryGeneratedInfo::PxCapsuleGeometryGeneratedInfo(void) ??0PxCapsuleGeometryGeneratedInfo@physx@@QAE@XZ
physx3cooking_x86.dll		PxCreateCooking
physx3common_x86.dll		class physx::PxVec3 __cdecl physx::PxDiagonalize(class physx::PxMat33 const &, class physx::PxQuat &) ?PxDiagonalize@physx@@YA?AVPxVec3@1@ABVPxMat33@1@AAVPxQuat@1@@Z
crashrpt1301.dll	16
dinput8.dll		DirectInput8Create
xinput1_3.dll	2

ord	entry_va	function_name
1	0x114a0	??0System@Scaleform@@QAE@ABUHeapDesc@MemoryHeap@1@PAVSysAllocBase@1@@Z
2	0x11480	??0System@Scaleform@@QAE@PAVSysAllocBase@1@@Z
3	0x113d0	??1AcquireInterface@Scaleform@@UAE@XZ
4	0x113d0	??1DefaultAcquireInterface@Scaleform@@UAE@XZ
5	0x114c0	??1System@Scaleform@@QAE@XZ
6	0x11450	??_FEvent@Scaleform@@QAEXXZ
7	0x11440	??_FMutex@Scaleform@@QAEXXZ
8	0x11460	??_FSemaphore@Scaleform@@QAEXXZ
9	0x10cfd0	??_FSysAllocPagedMalloc@Scaleform@@QAEXXZ
10	0x11310	??_FSysAllocStatic@Scaleform@@QAEXXZ
11	0x10cfe0	??_FSysAllocWinAPI@Scaleform@@QAEXXZ
12	0x11520	??_FSystem@Scaleform@@QAEXXZ
13	0x11470	??_FThread@Scaleform@@QAEXXZ
14	0x11cd0	?GetXScale@?$Matrix2x4@M@Render@Scaleform@@QBEMXZ
15	0x11cf0	?GetYScale@?$Matrix2x4@M@Render@Scaleform@@QBEMXZ
16	0x11560	?Init@System@GFx@Scaleform@@SAXPAVSysAllocBase@3@@Z
17	0x114d0	?Init@System@Scaleform@@SAXPAVSysAllocBase@2@@Z
18	0x1100d0	?Prepend@?$Matrix2x4@M@Render@Scaleform@@QAEAAV123@ABV123@@Z
19	0x11c90	?SetIdentity@?$Matrix2x4@M@Render@Scaleform@@QAEXXZ
20	0x11d10	?SetIdentity@?$Matrix3x4@M@Render@Scaleform@@QAEXXZ
21	0x11d40	?SetIdentity@?$Matrix4x4@M@Render@Scaleform@@QAEXXZ

module_name	Amazon.exe
flags	0
timestamp	2014-05-03 12:20:19
version	0.0
ordinal_base	1
nFunctions	21
nNames	21
Names(21)	0x13c40fc
Functions(21)	0x13c40a8
NameOrdinals(21)	0x13c407c

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	5056048	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK