filenameGame - 副本.exe
size9969152 (0x981e00)
md5904a6ee94bf58604746f7e93dcebf5f5
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x138

Rich Header

lib idversiontimes used
170402191
2106121942
147307294
131307293
156212022
123507272
171303191
199411182
2075092951
2055092970
20650929174
10154
1853071615
2076121987
201610301
15101
204610301

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections6
TimeDateStamp0x56eb646f
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x102
Magic0x10b
LinkerVersion11.0
SizeOfCode0xb1a00
SizeOfInitializedData0x355ce00
SizeOfUninitializedData0
AddressOfEntryPoint0x702d8
BaseOfCode0x1000
BaseOfData0xb3000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.0
ImageVersion0.0
SubsystemVersion6.0
Reserved10
SizeOfImage0x3612000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8140
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ 6.0 - 8.0

Sections

namevavsizeraw sizeflags
.text0x10000xb19da0xb1a00R-X CODE
.rdata0xb30000x3073e0x30800R-- IDATA
.data0xe40000x34a4a5c0x817e00RW- IDATA
_RDATA0x35890000xbe00xc00R-- IDATA
.rsrc0x358a0000x47b800x47c00R-- IDATA
.reloc0x35d20000x3f06a0x3f200R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT00
IMPORT0xe29640xf0
RESOURCE0x358a0000x47b80
EXCEPTION00
SECURITY00
BASERELOC0x35d20000xd378
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xe1f400x40
Bound_IAT00
IAT0xb30000x254
Delay_IAT00
CLR_Header00
typenamesizecp
CURSOR#132440
CURSOR#232440
ICON#32703760
ICON#496400
ICON#542640
ICON#611280
GROUP_CURSOR#108200
GROUP_CURSOR#111200
GROUP_ICON#112620
VERSION#16680
MANIFEST#13810
module_namehintordfunction_name
KERNEL32.dll987MapViewOfFile
KERNEL32.dll1427UnmapViewOfFile
KERNEL32.dll207CreateFileMappingA
KERNEL32.dll1375Sleep
KERNEL32.dll1205ResumeThread
KERNEL32.dll366ExitThread
KERNEL32.dll257CreateThread
KERNEL32.dll619GetLocalTime
KERNEL32.dll142CloseHandle
KERNEL32.dll784GetTickCount
KERNEL32.dll1270SetEndOfFile
KERNEL32.dll754GetSystemTime
KERNEL32.dll638GetModuleHandleA
KERNEL32.dll1085QueryPerformanceFrequency
KERNEL32.dll226CreateMutexA
KERNEL32.dll193CreateDirectoryA
KERNEL32.dll1044OutputDebugStringA
KERNEL32.dll540GetCurrentDirectoryA
KERNEL32.dll214CreateFileW
KERNEL32.dll1096RaiseException
KERNEL32.dll1520WriteConsoleW
KERNEL32.dll738GetStringTypeW
KERNEL32.dll945LCMapStringW
KERNEL32.dll963LoadLibraryW
KERNEL32.dll1045OutputDebugStringW
KERNEL32.dll852HeapReAlloc
KERNEL32.dll845HeapAlloc
KERNEL32.dll1210RtlUnwind
KERNEL32.dll502GetConsoleCP
KERNEL32.dll429FlushFileBuffers
KERNEL32.dll1112ReadFile
KERNEL32.dll316EncodePointer
KERNEL32.dll279DecodePointer
KERNEL32.dll899IsDebuggerPresent
KERNEL32.dll904IsProcessorFeaturePresent
KERNEL32.dll618GetLastError
KERNEL32.dll877InterlockedDecrement
KERNEL32.dll365ExitProcess
KERNEL32.dll640GetModuleHandleExW
KERNEL32.dll693GetProcAddress
KERNEL32.dll44AreFileApisANSI
KERNEL32.dll1004MultiByteToWideChar
KERNEL32.dll482GetCommandLineA
KERNEL32.dll320EnterCriticalSection
KERNEL32.dll957LeaveCriticalSection
KERNEL32.dll849HeapFree
KERNEL32.dll520GetConsoleMode
KERNEL32.dll1110ReadConsoleW
KERNEL32.dll1288SetFilePointer
KERNEL32.dll1289SetFilePointerEx
KERNEL32.dll733GetStdHandle
KERNEL32.dll599GetFileType
KERNEL32.dll870InitializeCriticalSectionAndSpinCount
KERNEL32.dll286DeleteCriticalSection
KERNEL32.dll727GetStartupInfoW
KERNEL32.dll854HeapSize
KERNEL32.dll1303SetLastError
KERNEL32.dll881InterlockedIncrement
KERNEL32.dll552GetCurrentThreadId
KERNEL32.dll1424UnhandledExceptionFilter
KERNEL32.dll1360SetUnhandledExceptionFilter
KERNEL32.dll547GetCurrentProcess
KERNEL32.dll1391TerminateProcess
KERNEL32.dll1409TlsAlloc
KERNEL32.dll1411TlsGetValue
KERNEL32.dll1412TlsSetValue
KERNEL32.dll1410TlsFree
KERNEL32.dll641GetModuleHandleW
KERNEL32.dll1521WriteFile
KERNEL32.dll637GetModuleFileNameW
KERNEL32.dll962LoadLibraryExW
KERNEL32.dll909IsValidCodePage
KERNEL32.dll446GetACP
KERNEL32.dll672GetOEMCP
KERNEL32.dll461GetCPInfo
KERNEL32.dll698GetProcessHeap
KERNEL32.dll636GetModuleFileNameA
KERNEL32.dll1084QueryPerformanceCounter
KERNEL32.dll548GetCurrentProcessId
KERNEL32.dll756GetSystemTimeAsFileTime
KERNEL32.dll576GetEnvironmentStringsW
KERNEL32.dll439FreeEnvironmentStringsW
KERNEL32.dll1501WideCharToMultiByte
KERNEL32.dll1327SetStdHandle
USER32.dll160DefWindowProcA
USER32.dll617PeekMessageA
USER32.dll181DispatchMessageA
USER32.dll827TranslateMessage
USER32.dll367GetMessageA
USER32.dll112CreateWindowExA
USER32.dll645RegisterClassExA
USER32.dll173DestroyWindow
USER32.dll796ShowWindow
USER32.dll545LoadIconA
USER32.dll541LoadCursorA
USER32.dll776SetWindowLongA
USER32.dll710SetCursor
USER32.dll580MessageBoxA
USER32.dll2AdjustWindowRect
USER32.dll458GetWindowRect
USER32.dll272GetActiveWindow
USER32.dll294GetClientRect
USER32.dll308GetCursorPos
USER32.dll450GetWindowInfo
USER32.dll691SendInput
USER32.dll425GetSystemMetrics
USER32.dll779SetWindowPos
bink2w32.dll69_BinkWait@4
bink2w32.dll1_BinkClose@4
bink2w32.dll4_BinkCopyToBuffer@28
bink2w32.dll26_BinkNextFrame@4
bink2w32.dll53_BinkSetSoundSystem@8
bink2w32.dll71_BinkWaitStopAsyncThreadsMulti@8
bink2w32.dll40_BinkRequestStopAsyncThreadsMulti@8
bink2w32.dll9_BinkDoFrameAsyncWait@8
bink2w32.dll35_BinkOpenXAudio2@4
bink2w32.dll27_BinkOpen@8
bink2w32.dll57_BinkSetVolume@12
bink2w32.dll59_BinkShouldSkip@4
bink2w32.dll61_BinkUtilCPUs@0
bink2w32.dll8_BinkDoFrameAsyncMulti@12
bink2w32.dll60_BinkStartAsyncThread@8
ADVAPI32.dll397InitializeSecurityDescriptor
ADVAPI32.dll739SetSecurityDescriptorDacl
SHELL32.dll236SHGetSpecialFolderLocation
SHELL32.dll226SHGetPathFromIDListA
ole32.dll116CoSetProxyBlanket
ole32.dll79CoInitializeEx
ole32.dll125CoUninitialize
ole32.dll25CoCreateInstance
ole32.dll438StringFromIID
ole32.dll78CoInitialize
OLEAUT32.dll6
OLEAUT32.dll2
d3d9.dll10Direct3DCreate9Ex
d3dx9_43.dll13D3DXCompileShader
DINPUT8.dllDirectInput8Create
WINMM.dll144timeBeginPeriod

StringTable 041104b0

CompanyNameMAGES.
FileDescriptionGame
FileVersion1.0.0.0
InternalNameGame.exe
LegalCopyright(C)M/5 (C)2008 5/N/R
OriginalFilenameGame.exe
ProductNameCHAOS;CHILD
ProductVersion1.0.0.0

VS_FIXEDFILEINFO

FileVersion1.0.0.0
ProductVersion1.0.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
15c115HTM#
15d09963568BINoverlay data past EOF#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK