crysis.exe

info
MZ
PE
resources
imports
exports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	crysis.exe
size	323584 (0x4f000)
md5	850e1f341dbe5f326ea850f80b83afd8

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|
00000040: 03 86 34 f8 47 e7 5a ab  47 e7 5a ab 47 e7 5a ab  |..4.G.Z.G.Z.G.Z.|
00000050: d0 23 24 ab 43 e7 5a ab  60 21 21 ab 45 e7 5a ab  |.#$.C.Z.`!!.E.Z.|
00000060: 60 21 27 ab 41 e7 5a ab  60 21 37 ab 52 e7 5a ab  |`!'.A.Z.`!7.R.Z.|
00000070: 84 e8 07 ab 40 e7 5a ab  47 e7 5b ab 1e e7 5a ab  |....@.Z.G.[...Z.|
00000080: 60 21 34 ab 44 e7 5a ab  60 21 20 ab 46 e7 5a ab  |`!4.D.Z.`! .F.Z.|
00000090: 60 21 26 ab 46 e7 5a ab  60 21 22 ab 46 e7 5a ab  |`!&.F.Z.`!".F.Z.|
000000a0: 52 69 63 68 47 e7 5a ab  63 91 3f 50 63 91 3f 50  |RichG.Z.c.?Pc.?P|
000000b0: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x65676e41
PointerToSymbolTable	0x6f6c426c
NumberOfSymbols	0x646f
SizeOfOptionalHeader	0xe0
Characteristics	0x123
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x2b000
SizeOfInitializedData	0x18000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x26ef7
BaseOfCode	0x1000
BaseOfData	0x2c000
ImageBase	0x37000000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x5b000
SizeOfHeaders	0x1000
CheckSum	0x447fb
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x300000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x2b000	0x2aead	R-X CODE
.rdata	0x2c000	0x5000	0x4a04	R-- IDATA
.data	0x31000	0xc000	0x818	RW- IDATA
.tls	0x3d000	0x1000	0	RW- IDATA
.rsrc	0x3e000	0xa000	0x91b0	R-- IDATA
.poison	0x48000	0x13000	0x12334	RWX CODE

Data Directory

type	va	size
EXPORT	0x309b0	0x54
IMPORT	0x3019c	0x64
RESOURCE	0x3e000	0x91b0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0x2c1a0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x30078	0x40
Bound_IAT	0	0
IAT	0x2c000	0x174
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
CURSOR	#1	4268	1252
CURSOR	#2	4268	1252
CURSOR	#3	4268	1252
CURSOR	#4	4268	1252
CURSOR	#5	4268	1252
ICON	#6	9640	1252
ICON	#7	4264	1252
GROUP_CURSOR	#103	20	1252
GROUP_CURSOR	#104	20	1252
GROUP_CURSOR	#105	20	1252
GROUP_CURSOR	#106	20	1252
GROUP_CURSOR	#107	20	1252
GROUP_ICON	#101	34	1252
VERSION	#1	528	1252
MANIFEST	#1	507	1252

module_name	hint	function_name
KERNEL32.dll	550	InterlockedCompareExchange
KERNEL32.dll	594	LoadLibraryA
KERNEL32.dll	416	GetProcAddress
KERNEL32.dll	383	GetModuleHandleA
KERNEL32.dll	120	DebugBreak
KERNEL32.dll	854	Sleep
KERNEL32.dll	75	CreateDirectoryA
KERNEL32.dll	320	GetCurrentDirectoryA
KERNEL32.dll	556	InterlockedIncrement
KERNEL32.dll	552	InterlockedDecrement
KERNEL32.dll	554	InterlockedExchangeAdd
KERNEL32.dll	547	InitializeCriticalSection
KERNEL32.dll	129	DeleteCriticalSection
KERNEL32.dll	152	EnterCriticalSection
KERNEL32.dll	874	TryEnterCriticalSection
KERNEL32.dll	593	LeaveCriticalSection
KERNEL32.dll	350	GetFileAttributesA
KERNEL32.dll	793	SetFileAttributesA
KERNEL32.dll	912	WaitForSingleObject
KERNEL32.dll	679	RaiseException
KERNEL32.dll	102	CreateProcessA
KERNEL32.dll	52	CloseHandle
KERNEL32.dll	248	FreeLibrary
KERNEL32.dll	369	GetLastError
KERNEL32.dll	96	CreateMutexA
KERNEL32.dll	188	ExpandEnvironmentStringsA
KERNEL32.dll	272	GetCommandLineA
KERNEL32.dll	323	GetCurrentProcessId
KERNEL32.dll	326	GetCurrentThreadId
KERNEL32.dll	479	GetTickCount
KERNEL32.dll	569	IsDebuggerPresent
KERNEL32.dll	878	UnhandledExceptionFilter
KERNEL32.dll	322	GetCurrentProcess
KERNEL32.dll	862	TerminateProcess
KERNEL32.dll	675	QueryPerformanceCounter
KERNEL32.dll	842	SetUnhandledExceptionFilter
KERNEL32.dll	439	GetStartupInfoA
KERNEL32.dll	553	InterlockedExchange
KERNEL32.dll	458	GetSystemTimeAsFileTime
USER32.dll	270	GetDesktopWindow
USER32.dll	242	GetAsyncKeyState
USER32.dll	479	MessageBoxA
USER32.dll	349	GetSystemMetrics
SHELL32.dll	263	ShellExecuteA
MSVCR80.dll	1370	sscanf
MSVCR80.dll	877	_set_purecall_handler
MSVCR80.dll	1297	islower
MSVCR80.dll	299	_beginthread
MSVCR80.dll	378	_except_handler3
MSVCR80.dll	1387	strncpy
MSVCR80.dll	1374	strchr
MSVCR80.dll	1334	memcpy
MSVCR80.dll	523	_i64toa
MSVCR80.dll	993	_ui64toa
MSVCR80.dll	1011	_unlock
MSVCR80.dll	153	__dllonexit
MSVCR80.dll	370	_encode_pointer
MSVCR80.dll	642	_lock
MSVCR80.dll	808	_onexit
MSVCR80.dll	360	_decode_pointer
MSVCR80.dll	285	_amsg_exit
MSVCR80.dll	162	__getmainargs
MSVCR80.dll	308	_cexit
MSVCR80.dll	388	_exit
MSVCR80.dll	105	_XcptFilter
MSVCR80.dll	561	_ismbblead
MSVCR80.dll	261	_acmdln
MSVCR80.dll	528	_initterm
MSVCR80.dll	529	_initterm_e
MSVCR80.dll	324	_configthreadlocale
MSVCR80.dll	235	__setusermatherr
MSVCR80.dll	275	_adjust_fdiv
MSVCR80.dll	206	__p__commode
MSVCR80.dll	210	__p__fmode
MSVCR80.dll	232	__set_app_type
MSVCR80.dll	379	_except_handler4_common
MSVCR80.dll	67	void __cdecl terminate(void) ?terminate@@YAXXZ
MSVCR80.dll	535	_invoke_watson
MSVCR80.dll	327	_controlfp_s
MSVCR80.dll	339	_crt_debugger_hook
MSVCR80.dll	1301	isupper
MSVCR80.dll	1423	vsprintf_s
MSVCR80.dll	1338	memset
MSVCR80.dll	1393	strstr
MSVCR80.dll	936	_stricmp
MSVCR80.dll	946	_strnicmp
MSVCR80.dll	653	_ltoa
MSVCR80.dll	1244	exit
MSVCR80.dll	997	_ultoa

ord	entry_va	function_name
1	0x22720	CryModuleGetMemoryInfo

module_name	Crysis.exe
flags	0
timestamp	2008-03-11 18:37:27
version	0.0
ordinal_base	1
nFunctions	1
nNames	1
Names(1)	0x309dc
Functions(1)	0x309d8
NameOrdinals(1)	0x309e0

StringTable 000904b0

CompanyName	Crytek GmbH
FileVersion	1, 1, 1, 6156
LegalCopyright	(C) 2007 Crytek GmbH
ProductName	Crysis
ProductVersion	1, 1, 1, 6156

VS_FIXEDFILEINFO

FileVersion	1.1.1.6156
ProductVersion	1.1.1.6156
StrucVersion	0x10000
FileFlagsMask	0x17
FileFlags	0
FileOS	4
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	320308	EXE	11/29/2023 17:00:49	#
15c1	15	HTM		#
4e334	3276	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 323584 bytes (316 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[!] non-zero dos stub after rich_hdr: "c\x91?Pc\x91?P\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"