Generals.exe

info
MZ
PE
resources
imports
foremost
7zip
hexdump
disasm
log
discuss
donate

filename	Generals.exe
size	96396 (0x1788c)
md5	89ddb433c82a488275898d314ee7e6af

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf8

Rich Header

lib id	version	times used
12	7291	5
11	8047	9
14	7299	20
10	8047	120
11	8168	5
0	0	3
19	8034	11
1	0	134
49	9044	18
6	1735	1
4	8447	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x4b536944
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x15000
SizeOfInitializedData	0xe000
SizeOfUninitializedData	0
AddressOfEntryPoint	0x21001
BaseOfCode	0x1000
BaseOfData	0x10000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x29000
SizeOfHeaders	0x1000
CheckSum	0x28516
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

ASPack v2.11

This file is packed with ASPack. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xf000	0xac00	RW- IDATA
.rdata	0x10000	0x3000	0x1c00	RW- IDATA
.data	0x13000	0x5000	0xa00	RW- IDATA
.rsrc	0x18000	0x6000	0x600	RW- IDATA
.DDeMCod	0x1e000	0x2000	0x2000	RW- IDATA
.DDeMImp	0x20000	0x1000	0x600	RW- IDATA
.packit	0x21000	0x7000	0x6800	RW- IDATA
.data	0x28000	0x1000	0	RW- IDATA

Data Directory

type	va	size
EXPORT	0x12800	0x9c
IMPORT	0x2221c	0x178
RESOURCE	0x18000	0x5d40
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x220c4	8
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0
	0	0x100000

show previews

type	name	size
ICON	#1	296
ICON	#2	1384
ICON	#3	872
ICON	#4	744
ICON	#5	2216
ICON	#6	3240
ICON	#7	1640
ICON	#8	3752
ICON	#9	7336
DIALOG	#101	238
DIALOG	#103	150
STRING	#1	1124
GROUP_ICON	#102	132

module_name	ord	function_name
kernel32.dll		GetProcAddress
kernel32.dll		GetModuleHandleA
kernel32.dll		LoadLibraryA
user32.dll		PostThreadMessageA
gdi32.dll		CreateCompatibleDC
advapi32.dll		LookupPrivilegeValueA
shell32.dll		ShellExecuteA
comctl32.dll	17
user32.dll		MessageBoxA

show previews

offset	size	type	comment
0	95744	EXE	01/17/2010 19:47:16	#
15c1	15	HTM		#
17600	652	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 96396 bytes (95 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x1d74c

[?] can't find file_offset of VA 0x1d83a

[?] can't find file_offset of VA 0x1d8d0

[?] can't find file_offset of VA 0x12800

[?] can't find file_offset of VA 0x0

[?] can't find file_offset of VA 0x12800