filenameOrcsMustDie.exe
size173568 (0x2a600)
md5944726ec463505d82c35c603f932f97e
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x108

DOS stub

00000000: 56 4c 56 00 01 00 00 00  00 5e 08 00 71 32 86 4e  |VLV......^..q2.N|
00000010: 8d fb 41 66 95 0c 88 59  53 dd ae e9 d1 b3 c4 bf  |..Af...YS.......|
00000020: 83 b2 75 c4 eb 2d 37 59  17 f8 c5 26 14 c8 1f 2f  |..u..-7Y...&.../|
00000030: 0b 72 94 79 89 f9 3d 69  4c 36 8c 42 e0 4a 71 e1  |.r.y..=iL6.B.Jq.|
00000040: c8 b0 af 7b a5 f5 fc 83  38 d1 21 09 9a 00 90 7e  |...{....8.!....~|
00000050: 2a 8c 8c ef d2 48 42 4c  81 c5 f2 46 45 ae ad e4  |*....HBL...FE...|
00000060: c5 a6 ee 0d 50 0b 33 70  a9 18 9c ca ea 75 2e 98  |....P.3p.....u..|
00000070: af 70 c4 a9 cc 01 7d 02  bb ca 9b 7d fb 0b ed a4  |.p....}....}....|
00000080: ab 4a 35 f4 76 46 3e 86  5f 81 0a 91 3a f6 44 89  |.J5.vF>._...:.D.|
00000090: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0: 00 00 00 00 00 00 00 00                           |........        |

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4e861dbb
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion9.0
SizeOfCode0x6c00
SizeOfInitializedData0x23600
SizeOfUninitializedData0
AddressOfEntryPoint0x6f5e
BaseOfCode0x1000
BaseOfData0x8000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion5.0
ImageVersion0.0
SubsystemVersion5.0
Reserved10
SizeOfImage0x96000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0x8100
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x70000x6c00R-X CODE
.rdata0x80000x50000x4400R-- IDATA
.data0xd0000x840000x1a400RW- IDATA
.rsrc0x910000x4c480x4e00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xbab00x8c
RESOURCE0x910000x4c48
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG0x81b00x1c
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xb8c00x40
Bound_IAT00
IAT0x80000x150
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#1169361252
DIALOG#1017821252
GROUP_ICON#101201252
VERSION#18121252
MANIFEST#15981252
module_namehintordfunction_name
KERNEL32.dll891ReleaseSemaphore
KERNEL32.dll1124WaitForSingleObject
KERNEL32.dll153CreateSemaphoreA
KERNEL32.dll591GetSystemTimeAsFileTime
KERNEL32.dll614GetTickCount
KERNEL32.dll852QueryPerformanceCounter
KERNEL32.dll1086UnhandledExceptionFilter
KERNEL32.dll569GetStartupInfoA
KERNEL32.dll698InterlockedCompareExchange
KERNEL32.dll1057Sleep
KERNEL32.dll701InterlockedExchange
KERNEL32.dll751LeaveCriticalSection
KERNEL32.dll217EnterCriticalSection
KERNEL32.dll190DeleteCriticalSection
KERNEL32.dll692InitializeCriticalSection
KERNEL32.dll967SetCurrentDirectoryW
KERNEL32.dll424GetCurrentDirectoryW
KERNEL32.dll1069TerminateProcess
KERNEL32.dll85CompareStringW
KERNEL32.dll1045SetUnhandledExceptionFilter
KERNEL32.dll721IsDebuggerPresent
KERNEL32.dll429GetCurrentThreadId
KERNEL32.dll426GetCurrentProcessId
KERNEL32.dll425GetCurrentProcess
KERNEL32.dll332FreeLibrary
KERNEL32.dll756LoadLibraryW
KERNEL32.dll630GetVersionExW
KERNEL32.dll1146WideCharToMultiByte
KERNEL32.dll794MultiByteToWideChar
Vision90.dll1845public: bool __thiscall VisPluginManager_cl::LoadEnginePlugin(char const *)

?LoadEnginePlugin@VisPluginManager_cl@@QAE_NPBD@Z

Vision90.dll2039public: static class VisPluginManager_cl Vision::Plugins

?Plugins@Vision@@2VVisPluginManager_cl@@A

Vision90.dll967public: void __cdecl VisError_cl::FatalError(char const *, ...)

?FatalError@VisError_cl@@QAAXPBDZZ

Vision90.dll954public: static class VisError_cl Vision::Error

?Error@Vision@@2VVisError_cl@@A

vBase90.dll331public: __thiscall VString::~VString(void)

??1VString@@QAE@XZ

vBase90.dll3158void __cdecl VBaseDealloc_rel(void *)

?VBaseDealloc_rel@@YAXPAX@Z

vBase90.dll187public: __thiscall VString::VString(char const *)

??0VString@@QAE@PBD@Z

vBase90.dll3156void * __cdecl VBaseAlloc_rel(unsigned int)

?VBaseAlloc_rel@@YAPAXI@Z

SaberPlugin.vplugin66int __cdecl appMain(char *)

?appMain@@YAHPAD@Z

MSVCR90.dll54public: void __thiscall type_info::_type_info_dtor_internal_method(void)

?_type_info_dtor_internal_method@type_info@@QAEXXZ

MSVCR90.dll1322memset
MSVCR90.dll1318memcpy
MSVCR90.dll1320memmove
MSVCR90.dll319_controlfp_s
MSVCR90.dll523_invoke_watson
MSVCR90.dll371_except_handler4_common
MSVCR90.dll67void __cdecl terminate(void)

?terminate@@YAXXZ

MSVCR90.dll331_crt_debugger_hook
MSVCR90.dll352_decode_pointer
MSVCR90.dll796_onexit
MSVCR90.dll630_lock
MSVCR90.dll150__dllonexit
MSVCR90.dll998_unlock
MSVCR90.dll224__set_app_type
MSVCR90.dll362_encode_pointer
MSVCR90.dll207__p__fmode
MSVCR90.dll203__p__commode
MSVCR90.dll267_adjust_fdiv
MSVCR90.dll227__setusermatherr
MSVCR90.dll316_configthreadlocale
MSVCR90.dll517_initterm_e
MSVCR90.dll516_initterm
MSVCR90.dll253_acmdln
MSVCR90.dll1228exit
MSVCR90.dll549_ismbblead
MSVCR90.dll102_XcptFilter
MSVCR90.dll380_exit
MSVCR90.dll300_cexit
MSVCR90.dll159__getmainargs
MSVCR90.dll277_amsg_exit
MSVCR90.dll922_stricmp
MSVCR90.dll317_control87
MSVCR90.dll1083_wcsnicmp
MSVCR90.dll1307malloc
MSVCR90.dll1338realloc
MSVCR90.dll1040_vsnwprintf
MSVCR90.dll1252free
MSVCR90.dll90_CxxThrowException
WINMM.dll148timeGetTime

StringTable 040904b0

CompanyNameRobot Entertainment, Inc.
FileDescriptionOrcs Must Die!
FileVersion0001.0000.0000.2383
InternalNameSpartan
LegalCopyrightCopyright 2011 Robot Entertainment, Inc.
OriginalFilenameOMD.exe
ProductNameOrcs Must Die!
ProductVersion0001.0000.0000.2383

VS_FIXEDFILEINFO

FileVersion1.0.0.2383
ProductVersion1.0.0.2383
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0173568EXE09/30/2011 19:51:23#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK