rzrchip3.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	rzrchip3.exe
size	841728 (0xcd800)
md5	9c630ec66262318b4e658e07c7c5db6d

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x2a425e19
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0xcc000
SizeOfInitializedData	0x2000
SizeOfUninitializedData	0x9b000
AddressOfEntryPoint	0x167db0
BaseOfCode	0x9c000
BaseOfData	0x168000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x16a000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX v0.89.6 - v1.02 / v1.05 - v1.22

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x9b000	0	RWX UDATA
UPX1	0x9c000	0xcc000	0xcc000	RWX IDATA
.rsrc	0x168000	0x2000	0x1400	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1691a0	0x114
RESOURCE	0x168000	0x11a0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x167f18	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x567f30	0x567f38	0x4074bc	0	0	0

show previews

type	name	size
ICON	#50	744
RCDATA	CONFIG	4
RCDATA	DVCLAL	16
RCDATA	F1	204301
RCDATA	F10	11460
RCDATA	F11	9419
RCDATA	F12	4899
RCDATA	F13	4727
RCDATA	F14	5136
RCDATA	F15	6021
RCDATA	F16	8789
RCDATA	F17	6761
RCDATA	F18	434398
RCDATA	F19	9889
RCDATA	F2	33051
RCDATA	F20	5809
RCDATA	F21	4284
RCDATA	F22	4025
RCDATA	F23	4362
RCDATA	F24	1366
RCDATA	F25	2647
RCDATA	F26	2680
RCDATA	F27	7044
RCDATA	F28	4481
RCDATA	F29	3749
RCDATA	F3	6392
RCDATA	F30	10406
RCDATA	F31	34669
RCDATA	F32	6945
RCDATA	F33	541
RCDATA	F34	13103
RCDATA	F35	17661
RCDATA	F36	19213
RCDATA	F37	3191
RCDATA	F38	554
RCDATA	F39	13367
RCDATA	F4	22533
RCDATA	F40	17661
RCDATA	F41	41390
RCDATA	F42	4332
RCDATA	F43	543
RCDATA	F44	13147
RCDATA	F45	17661
RCDATA	F46	15458
RCDATA	F47	2571
RCDATA	F48	548
RCDATA	F49	14911
RCDATA	F5	26956
RCDATA	F50	18917
RCDATA	F51	22730
RCDATA	F52	4577
RCDATA	F53	46015
RCDATA	F54	5029
RCDATA	F55	13229
RCDATA	F56	7237
RCDATA	F57	21213
RCDATA	F58	6803
RCDATA	F59	10066
RCDATA	F6	9346
RCDATA	F60	7538
RCDATA	F7	6317
RCDATA	F8	29716
RCDATA	F9	110601
RCDATA	PACKAGEINFO	52
GROUP_ICON	MAINICON	20

module_name	hint	ord	function_name
KERNEL32.DLL			LoadLibraryA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			ExitProcess
advapi32.dll			RegCloseKey
oleaut32.dll			VariantClear
user32.dll			CharNextA

show previews

offset	size	type	comment
0	841728	EXE	06/19/1992 22:22:17	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0xd184

[?] can't find file_offset of VA 0xd188

[?] can't find file_offset of VA 0xd198

[?] can't find file_offset of VA 0x3efa8

[?] can't find file_offset of VA 0x41c6c

[?] can't find file_offset of VA 0x44138

[?] can't find file_offset of VA 0x4545c

[?] can't find file_offset of VA 0x466d4

[?] can't find file_offset of VA 0x47ae4

[?] can't find file_offset of VA 0x4926c

[?] can't find file_offset of VA 0x4b4c4

[?] can't find file_offset of VA 0x4cf30

[?] can't find file_offset of VA 0x74bc