filenameRO2Bot.exe
size1048576 (0x100000)
md563f49dc1d537e1c3bb2e1dcb8c0a7972
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
126503276
95403514
1255072736
10950727236
93403533
10658
11050727266
1145072754
122507271
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x51f0e26f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion8.0
SizeOfCode0x2a0000
SizeOfInitializedData0x47000
SizeOfUninitializedData0
AddressOfEntryPoint0x29c448
BaseOfCode0x1000
BaseOfData0xfc000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x1000
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x2a2000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Sections

namevavsizeraw sizeflags
.text0x10000xfa65f0R-X CODE
.rdata0xfc0000x2aa0c0R-- IDATA
.data0x1270000x12afc0RW- IDATA
.rsrc0x13a0000x80300x6000R-- IDATA
.vmp00x1430000x650180RWX CODE IDATA
.vmp10x1a90000xf79f80xf8000RWX CODE DISCARDABLE
.reloc0x2a10000x480x1000R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x1a91610x15c
IMPORT0x29dde20x17c
RESOURCE0x13a0000x8030
EXCEPTION00
SECURITY00
BASERELOC0x2a10000x48
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x2a09b80x40
Bound_IAT00
IAT0x1bb10a0x6f8
Delay_IAT0x1244880x40
CLR_Header00
typenamesizecp
CURSOR#23080
CURSOR#31800
CURSOR#43080
CURSOR#53080
CURSOR#63080
CURSOR#73080
CURSOR#83080
CURSOR#93080
CURSOR#103080
CURSOR#113080
CURSOR#123080
CURSOR#133080
CURSOR#143080
CURSOR#153080
CURSOR#163080
CURSOR#173080
BITMAP#309941840
BITMAP#309963240
ICON#1169360
DIALOG#1301100
DIALOG#1332400
DIALOG#307212320
DIALOG#30734520
STRING#38411300
STRING#3842420
STRING#38434020
STRING#385712500
STRING#38587940
STRING#38597320
STRING#38601380
STRING#38651720
STRING#38662220
STRING#386712200
STRING#38686120
STRING#3869440
STRING#3887660
GROUP_CURSOR#30977340
GROUP_CURSOR#30998200
GROUP_CURSOR#30999200
GROUP_CURSOR#31000200
GROUP_CURSOR#31001200
GROUP_CURSOR#31002200
GROUP_CURSOR#31003200
GROUP_CURSOR#31004200
GROUP_CURSOR#31005200
GROUP_CURSOR#31006200
GROUP_CURSOR#31007200
GROUP_CURSOR#31008200
GROUP_CURSOR#31009200
GROUP_CURSOR#31010200
GROUP_CURSOR#31011200
GROUP_ICON#128200
VERSION#18240
module_namehintordfunction_name
WS2_32.dll20
WS2_32.dll112
WS2_32.dll19
WS2_32.dll52
WS2_32.dll18
WS2_32.dll115
WS2_32.dll16
WS2_32.dll111
WS2_32.dll151
WS2_32.dll10
WS2_32.dll51
WS2_32.dll3
WS2_32.dll22
WS2_32.dll4
WS2_32.dll9
WS2_32.dll11
WS2_32.dll116
WS2_32.dll23
imagehlp.dllCheckSumMappedFile
PSAPI.DLLGetModuleInformation
KERNEL32.dllEnterCriticalSection
KERNEL32.dllLeaveCriticalSection
KERNEL32.dllLocalAlloc
KERNEL32.dllGlobalFlags
KERNEL32.dllTlsGetValue
KERNEL32.dllGlobalReAlloc
KERNEL32.dllGlobalHandle
KERNEL32.dllTlsAlloc
KERNEL32.dllTlsSetValue
KERNEL32.dllLocalReAlloc
KERNEL32.dllTlsFree
KERNEL32.dllMoveFileA
KERNEL32.dllDeleteFileA
KERNEL32.dllGetThreadLocale
KERNEL32.dllReadFile
KERNEL32.dllWriteFile
KERNEL32.dllSetFilePointer
KERNEL32.dllFlushFileBuffers
KERNEL32.dllLockFile
KERNEL32.dllUnlockFile
KERNEL32.dllSetEndOfFile
KERNEL32.dllGetFileSize
KERNEL32.dllDuplicateHandle
KERNEL32.dllFindClose
KERNEL32.dllGetVolumeInformationA
KERNEL32.dllGetFullPathNameA
KERNEL32.dllCreateFileA
KERNEL32.dllGetFileAttributesA
KERNEL32.dllGetFileTime
KERNEL32.dllGetCPInfo
KERNEL32.dllGetOEMCP
KERNEL32.dllSetErrorMode
KERNEL32.dllUnhandledExceptionFilter
KERNEL32.dllSetUnhandledExceptionFilter
KERNEL32.dllIsDebuggerPresent
KERNEL32.dllHeapReAlloc
KERNEL32.dllHeapAlloc
KERNEL32.dllDeleteCriticalSection
KERNEL32.dllVirtualAlloc
KERNEL32.dllGetSystemInfo
KERNEL32.dllExitThread
KERNEL32.dllCreateThread
KERNEL32.dllGetSystemTimeAsFileTime
KERNEL32.dllGetCommandLineA
KERNEL32.dllGetProcessHeap
KERNEL32.dllGetStartupInfoA
KERNEL32.dllWriteConsoleW
KERNEL32.dllGetFileType
KERNEL32.dllGetStdHandle
KERNEL32.dllRtlUnwind
KERNEL32.dllExitProcess
KERNEL32.dllHeapSize
KERNEL32.dllSetStdHandle
KERNEL32.dllSleep
KERNEL32.dllHeapDestroy
KERNEL32.dllHeapCreate
KERNEL32.dllVirtualFree
KERNEL32.dllGetACP
KERNEL32.dllIsValidCodePage
KERNEL32.dllGetConsoleCP
KERNEL32.dllGetConsoleMode
KERNEL32.dllSetHandleCount
KERNEL32.dllLCMapStringA
KERNEL32.dllLCMapStringW
KERNEL32.dllFreeEnvironmentStringsA
KERNEL32.dllGetEnvironmentStrings
KERNEL32.dllFreeEnvironmentStringsW
KERNEL32.dllGetEnvironmentStringsW
KERNEL32.dllQueryPerformanceCounter
KERNEL32.dllGetTimeZoneInformation
KERNEL32.dllLoadLibraryW
KERNEL32.dllGetStringTypeA
KERNEL32.dllGetStringTypeW
KERNEL32.dllGetTimeFormatA
KERNEL32.dllGetDateFormatA
KERNEL32.dllGetUserDefaultLCID
KERNEL32.dllEnumSystemLocalesA
KERNEL32.dllIsValidLocale
KERNEL32.dllWriteConsoleA
KERNEL32.dllGetConsoleOutputCP
KERNEL32.dllCreateFileW
KERNEL32.dllGetLocaleInfoW
KERNEL32.dllSetEnvironmentVariableA
KERNEL32.dllInitializeCriticalSection
KERNEL32.dllFileTimeToLocalFileTime
KERNEL32.dllFileTimeToSystemTime
KERNEL32.dllRaiseException
KERNEL32.dllFormatMessageA
KERNEL32.dllLocalFree
KERNEL32.dllMulDiv
KERNEL32.dllGlobalGetAtomNameA
KERNEL32.dllGlobalFindAtomA
KERNEL32.dlllstrcmpW
KERNEL32.dllGlobalAddAtomA
KERNEL32.dllGlobalUnlock
KERNEL32.dllFreeResource
KERNEL32.dllGlobalFree
KERNEL32.dllSetLastError
KERNEL32.dllGlobalDeleteAtom
KERNEL32.dllGetCurrentThread
KERNEL32.dllConvertDefaultLocale
KERNEL32.dllEnumResourceLanguagesA
KERNEL32.dllGetLocaleInfoA
KERNEL32.dllLoadLibraryExA
KERNEL32.dllGlobalLock
KERNEL32.dlllstrcmpA
KERNEL32.dllGlobalAlloc
KERNEL32.dllFreeLibrary
KERNEL32.dllOpenFileMappingA
KERNEL32.dllInterlockedIncrement
KERNEL32.dllGetThreadContext
KERNEL32.dllFlushInstructionCache
KERNEL32.dllSetThreadContext
KERNEL32.dllCreateRemoteThread
KERNEL32.dllGetCurrentProcessId
KERNEL32.dllVirtualProtectEx
KERNEL32.dllReadProcessMemory
KERNEL32.dllVirtualAllocEx
KERNEL32.dllWriteProcessMemory
KERNEL32.dllModule32First
KERNEL32.dllModule32Next
KERNEL32.dllGetCurrentProcess
KERNEL32.dllGetProcAddress
KERNEL32.dllIsBadReadPtr
KERNEL32.dllThread32First
KERNEL32.dllGetCurrentThreadId
KERNEL32.dllOpenThread
KERNEL32.dllSuspendThread
KERNEL32.dllThread32Next
KERNEL32.dllGetVersionExA
KERNEL32.dllOpenProcess
KERNEL32.dllWaitForSingleObject
KERNEL32.dllTerminateProcess
KERNEL32.dllGetLocalTime
KERNEL32.dllWritePrivateProfileStringA
KERNEL32.dllInterlockedCompareExchange
KERNEL32.dllVirtualQuery
KERNEL32.dllInterlockedDecrement
KERNEL32.dllVirtualProtect
KERNEL32.dllGetTempPathA
KERNEL32.dllGetModuleHandleA
KERNEL32.dllGetTickCount
KERNEL32.dllCreateToolhelp32Snapshot
KERNEL32.dllLoadLibraryA
KERNEL32.dllUnmapViewOfFile
KERNEL32.dllMapViewOfFile
KERNEL32.dllCreateFileMappingA
KERNEL32.dllResumeThread
KERNEL32.dllLockResource
KERNEL32.dllCreateProcessA
KERNEL32.dllSizeofResource
KERNEL32.dllLoadResource
KERNEL32.dllFindResourceA
KERNEL32.dllCloseHandle
KERNEL32.dllGetLastError
KERNEL32.dllMultiByteToWideChar
KERNEL32.dllGetVersion
KERNEL32.dllCompareStringW
KERNEL32.dllCompareStringA
KERNEL32.dllInterlockedExchange
KERNEL32.dlllstrlenA
KERNEL32.dllWideCharToMultiByte
KERNEL32.dllFindFirstFileA
KERNEL32.dllGetModuleFileNameA
KERNEL32.dllGetModuleFileNameW
KERNEL32.dllReleaseMutex
KERNEL32.dllOutputDebugStringA
KERNEL32.dlllstrcatA
KERNEL32.dlllstrcpyA
KERNEL32.dllHeapFree
USER32.dllCopyAcceleratorTableA
USER32.dllCharNextA
USER32.dllPostThreadMessageA
USER32.dllLoadCursorA
USER32.dllGetSysColorBrush
USER32.dllEndPaint
USER32.dllBeginPaint
USER32.dllGetWindowDC
USER32.dllReleaseDC
USER32.dllGetDC
USER32.dllClientToScreen
USER32.dllGrayStringA
USER32.dllDrawTextExA
USER32.dllDrawTextA
USER32.dllTabbedTextOutA
USER32.dllRegisterWindowMessageA
USER32.dllLoadIconA
USER32.dllWinHelpA
USER32.dllIsChild
USER32.dllGetCapture
USER32.dllGetClassLongA
USER32.dllGetClassNameA
USER32.dllSetPropA
USER32.dllGetPropA
USER32.dllRemovePropA
USER32.dllGetForegroundWindow
USER32.dllGetTopWindow
USER32.dllGetMessageTime
USER32.dllGetMessagePos
USER32.dllMapWindowPoints
USER32.dllUpdateWindow
USER32.dllDestroyMenu
USER32.dllGetMenu
USER32.dllGetSubMenu
USER32.dllGetMenuItemID
USER32.dllGetMenuItemCount
USER32.dllCreateWindowExA
USER32.dllGetClassInfoExA
USER32.dllGetClassInfoA
USER32.dllRegisterClassA
USER32.dllGetSysColor
USER32.dllAdjustWindowRectEx
USER32.dllEqualRect
USER32.dllCopyRect
USER32.dllPtInRect
USER32.dllSetRect
USER32.dllDefWindowProcA
USER32.dllCallWindowProcA
USER32.dllOffsetRect
USER32.dllIntersectRect
USER32.dllSystemParametersInfoA
USER32.dllIsIconic
USER32.dllGetWindowPlacement
USER32.dllGetWindowRect
USER32.dllGetWindowTextA
USER32.dllSetFocus
USER32.dllSetWindowLongA
USER32.dllGetDlgCtrlID
USER32.dllSetWindowTextA
USER32.dllIsDialogMessageA
USER32.dllSendDlgItemMessageA
USER32.dllUnhookWindowsHookEx
USER32.dllSetCursor
USER32.dllSetWindowsHookExA
USER32.dllCallNextHookEx
USER32.dllGetMessageA
USER32.dllTranslateMessage
USER32.dllGetCursorPos
USER32.dllValidateRect
USER32.dllGetDesktopWindow
USER32.dllGetActiveWindow
USER32.dllSetActiveWindow
USER32.dllGetSystemMetrics
USER32.dllCreateDialogIndirectParamA
USER32.dllDestroyWindow
USER32.dllGetDlgItem
USER32.dllGetNextDlgTabItem
USER32.dllEndDialog
USER32.dllGetWindow
USER32.dllSetWindowContextHelpId
USER32.dllMapDialogRect
USER32.dllSetWindowPos
USER32.dllUnregisterClassA
USER32.dllRegisterClipboardFormatA
USER32.dllGetWindowLongA
USER32.dllMessageBeep
USER32.dllGetNextDlgGroupItem
USER32.dllReleaseCapture
USER32.dllSetCapture
USER32.dllInvalidateRgn
USER32.dllGetClientRect
USER32.dllInvalidateRect
USER32.dllGetLastActivePopup
USER32.dllIsWindowEnabled
USER32.dllPeekMessageA
USER32.dllDispatchMessageA
USER32.dllSetMenuItemBitmaps
USER32.dllGetMenuCheckMarkDimensions
USER32.dllLoadBitmapA
USER32.dllGetFocus
USER32.dllGetParent
USER32.dllModifyMenuA
USER32.dllGetMenuState
USER32.dllEnableMenuItem
USER32.dllCheckMenuItem
USER32.dllPostQuitMessage
USER32.dllIsWindowVisible
USER32.dllKillTimer
USER32.dllGetWindowThreadProcessId
USER32.dllGetClassNameW
USER32.dllGetWindowTextW
USER32.dllSetWindowTextW
USER32.dllIsWindow
USER32.dllEnumChildWindows
USER32.dllPostMessageA
USER32.dllGetKeyState
USER32.dllMessageBoxA
USER32.dllCharUpperA
USER32.dllEnableWindow
USER32.dllSendMessageA
USER32.dllSetForegroundWindow
USER32.dllShowWindow
USER32.dllFindWindowA
USER32.dllSetTimer
USER32.dllIsRectEmpty
USER32.dllMoveWindow
GDI32.dllDeleteDC
GDI32.dllGetStockObject
GDI32.dllGetBkColor
GDI32.dllGetTextColor
GDI32.dllExtSelectClipRgn
GDI32.dllGetRgnBox
GDI32.dllSetViewportOrgEx
GDI32.dllGetMapMode
GDI32.dllSelectObject
GDI32.dllEscape
GDI32.dllExtTextOutA
GDI32.dllTextOutA
GDI32.dllRectVisible
GDI32.dllScaleWindowExtEx
GDI32.dllSetBkColor
GDI32.dllSetWindowExtEx
GDI32.dllSetTextColor
GDI32.dllScaleViewportExtEx
GDI32.dllSetViewportExtEx
GDI32.dllGetClipBox
GDI32.dllCreateRectRgnIndirect
GDI32.dllCreateBitmap
GDI32.dllPtVisible
GDI32.dllGetWindowExtEx
GDI32.dllGetViewportExtEx
GDI32.dllDeleteObject
GDI32.dllSetMapMode
GDI32.dllRestoreDC
GDI32.dllSaveDC
GDI32.dllGetDeviceCaps
GDI32.dllGetObjectA
GDI32.dllOffsetViewportOrgEx
comdlg32.dllGetFileTitleA
WINSPOOL.DRVClosePrinter
WINSPOOL.DRVDocumentPropertiesA
WINSPOOL.DRVOpenPrinterA
ADVAPI32.dllRegEnumKeyA
ADVAPI32.dllReportEventA
ADVAPI32.dllRegisterEventSourceA
ADVAPI32.dllDeregisterEventSource
ADVAPI32.dllRegQueryValueA
ADVAPI32.dllRegOpenKeyA
ADVAPI32.dllRegDeleteValueA
ADVAPI32.dllRegDeleteKeyA
ADVAPI32.dllRegSetValueExA
ADVAPI32.dllRegCreateKeyExA
ADVAPI32.dllRegQueryValueExA
ADVAPI32.dllRegCloseKey
ADVAPI32.dllRegEnumValueA
ADVAPI32.dllRegQueryInfoKeyA
ADVAPI32.dllRegOpenKeyExA
SHELL32.dllSHFileOperationA
COMCTL32.dllInitCommonControlsEx
SHLWAPI.dllPathFindExtensionA
SHLWAPI.dllPathStripToRootA
SHLWAPI.dllPathFindFileNameA
SHLWAPI.dllPathIsUNCA
oledlg.dll8
ole32.dllStgOpenStorageEx
ole32.dllCoTaskMemFree
ole32.dllOleUninitialize
ole32.dllCoFreeUnusedLibraries
ole32.dllOleInitialize
ole32.dllCLSIDFromProgID
ole32.dllCLSIDFromString
ole32.dllStgCreateDocfile
ole32.dllCoTaskMemAlloc
ole32.dllCoGetClassObject
ole32.dllCoRevokeClassObject
ole32.dllOleIsCurrentClipboard
ole32.dllOleFlushClipboard
ole32.dllCoRegisterMessageFilter
ole32.dllStgOpenStorageOnILockBytes
ole32.dllStgCreateDocfileOnILockBytes
ole32.dllCreateILockBytesOnHGlobal
ole32.dllCoDisconnectObject
OLEAUT32.dll2
OLEAUT32.dll161
OLEAUT32.dll15
OLEAUT32.dll18
OLEAUT32.dll23
OLEAUT32.dll24
OLEAUT32.dll16
OLEAUT32.dll420
OLEAUT32.dll162
OLEAUT32.dll146
OLEAUT32.dll150
OLEAUT32.dll7
OLEAUT32.dll185
OLEAUT32.dll184
OLEAUT32.dll4
OLEAUT32.dll9
OLEAUT32.dll10
OLEAUT32.dll12
OLEAUT32.dll8
OLEAUT32.dll6
WININET.dllInternetQueryDataAvailable
WININET.dllHttpOpenRequestA
WININET.dllInternetConnectA
WININET.dllHttpSendRequestA
WININET.dllInternetReadFile
WININET.dllInternetWriteFile
WININET.dllInternetSetFilePointer
WININET.dllInternetSetStatusCallback
WININET.dllInternetOpenA
WININET.dllInternetGetLastResponseInfoA
WININET.dllInternetCloseHandle
WININET.dllInternetSetOptionA
KERNEL32.dllVirtualProtect
KERNEL32.dllGetModuleFileNameA
KERNEL32.dllExitProcess
USER32.dllMessageBoxA
ordentry_vafunction_name
10x202a0?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@VShareHitchAcount@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z
20x20280?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@VShareHitchAcount@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z
module_nameRO2Bot.exe
flags0
timestamp2013-07-25 08:31:33
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x1a9195
Functions(2)0x1a9189
NameOrdinals(2)0x1a9191

StringTable 040904e4

CompanyNameTODO: <Company name>
FileDescriptionTODO: <File description>
FileVersion1.0.0.1
InternalNameLauncher.exe
LegalCopyrightTODO: (c) <Company name>. All rights reserved.
OriginalFilenameLauncher.exe
ProductNameTODO: <Product name>
ProductVersion1.0.0.1

VS_FIXEDFILEINFO

FileVersion1.0.0.1
ProductVersion1.0.0.1
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType1
FileSubtype0
offsetsizetypecomment
01048576EXE07/25/2013 08:31:43#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x14008c
[?] can't find file_offset of VA 0x1401c0
[?] ignoring invalid PEdump::BITMAPINFOHEADER
[?] can't find file_offset of VA 0x1402f4
[?] can't find file_offset of VA 0x1403ac
[?] can't find file_offset of VA 0x1404f0
[?] can't find file_offset of VA 0x140560
[?] can't find file_offset of VA 0x140650
[?] can't find file_offset of VA 0x140738
[?] can't find file_offset of VA 0x14076c
[?] can't find file_offset of VA 0x1407f0
[?] can't find file_offset of VA 0x14081c
[?] can't find file_offset of VA 0x1409b0
[?] can't find file_offset of VA 0x140e94
[?] can't find file_offset of VA 0x1411b0
[?] can't find file_offset of VA 0x14148c
[?] can't find file_offset of VA 0x141518
[?] can't find file_offset of VA 0x1415c4
[?] can't find file_offset of VA 0x1416a4
[?] can't find file_offset of VA 0x141b68
[?] can't find file_offset of VA 0x141dcc
[?] can't find file_offset of VA 0x141df8
[?] can't find file_offset of VA 0x141e3c
[?] can't find file_offset of VA 0x141e60
[?] can't find file_offset of VA 0x141e74
[?] can't find file_offset of VA 0x141e88
[?] can't find file_offset of VA 0x141e9c
[?] can't find file_offset of VA 0x141eb0
[?] can't find file_offset of VA 0x141ec4
[?] can't find file_offset of VA 0x141ed8
[?] can't find file_offset of VA 0x141eec
[?] can't find file_offset of VA 0x141f00
[?] can't find file_offset of VA 0x141f14
[?] can't find file_offset of VA 0x141f28
[?] can't find file_offset of VA 0x141f3c
[?] can't find file_offset of VA 0x141f50
[?] can't find file_offset of VA 0x141f64
[?] can't find file_offset of VA 0x124488