rzrchip3.unpacked.exe

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

parent	rzrchip3.exe
filename	rzrchip3.unpacked.exe
size	1428992 (0x15ce00)
md5	a97cb6fc9ac6a6006d3da1823c6f849f

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x50
blocks_in_file	2
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0xf
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0x1a
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	8
TimeDateStamp	0x2a425e19
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x818f
Magic	0x10b
LinkerVersion	2.25
SizeOfCode	0x4400
SizeOfInitializedData	0x158c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4dc4
BaseOfCode	0x1000
BaseOfData	0x6000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	1.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x164000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x4000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

Sections

name	va	vsize	raw size	flags
CODE	0x1000	0x4314	0x4400	R-X CODE
DATA	0x6000	0xd8	0x200	RW- IDATA
BSS	0x7000	0x839	0	RW-
.idata	0x8000	0x770	0x800	RW- IDATA
.tls	0x9000	8	0	RW-
.rdata	0xa000	0x18	0x200	R-- IDATA SHARED
.reloc	0xb000	0x468	0	R-- IDATA SHARED
.rsrc	0xc000	0x157860	0x157a00	R-- IDATA SHARED

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x8000	0x770
RESOURCE	0xc000	0x157860
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0xa000	0x18
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x409000	0x409008	0x4074bc	0x40a010	0	0

show previews

type	name	size
ICON	#50	744
RCDATA	CONFIG	4
RCDATA	DVCLAL	16
RCDATA	F1	204301
RCDATA	F10	11460
RCDATA	F11	9419
RCDATA	F12	4899
RCDATA	F13	4727
RCDATA	F14	5136
RCDATA	F15	6021
RCDATA	F16	8789
RCDATA	F17	6761
RCDATA	F18	434398
RCDATA	F19	9889
RCDATA	F2	33051
RCDATA	F20	5809
RCDATA	F21	4284
RCDATA	F22	4025
RCDATA	F23	4362
RCDATA	F24	1366
RCDATA	F25	2647
RCDATA	F26	2680
RCDATA	F27	7044
RCDATA	F28	4481
RCDATA	F29	3749
RCDATA	F3	6392
RCDATA	F30	10406
RCDATA	F31	34669
RCDATA	F32	6945
RCDATA	F33	541
RCDATA	F34	13103
RCDATA	F35	17661
RCDATA	F36	19213
RCDATA	F37	3191
RCDATA	F38	554
RCDATA	F39	13367
RCDATA	F4	22533
RCDATA	F40	17661
RCDATA	F41	41390
RCDATA	F42	4332
RCDATA	F43	543
RCDATA	F44	13147
RCDATA	F45	17661
RCDATA	F46	15458
RCDATA	F47	2571
RCDATA	F48	548
RCDATA	F49	14911
RCDATA	F5	26956
RCDATA	F50	18917
RCDATA	F51	22730
RCDATA	F52	4577
RCDATA	F53	46015
RCDATA	F54	5029
RCDATA	F55	13229
RCDATA	F56	7237
RCDATA	F57	21213
RCDATA	F58	6803
RCDATA	F59	10066
RCDATA	F6	9346
RCDATA	F60	7538
RCDATA	F7	6317
RCDATA	F8	29716
RCDATA	F9	110601
RCDATA	PACKAGEINFO	52
GROUP_ICON	MAINICON	20

module_name	hint	ord	function_name
KERNEL32.DLL			LockResource
KERNEL32.DLL			LoadResource
KERNEL32.DLL			SizeofResource
KERNEL32.DLL			FindResourceA
KERNEL32.DLL			Sleep
KERNEL32.DLL			GetExitCodeProcess
KERNEL32.DLL			CreateProcessA
KERNEL32.DLL			CopyFileA
KERNEL32.DLL			DeleteFileA
KERNEL32.DLL			RemoveDirectoryA
KERNEL32.DLL			GetSystemDirectoryA
KERNEL32.DLL			GetWindowsDirectoryA
KERNEL32.DLL			GetFileAttributesA
KERNEL32.DLL			GetLastError
KERNEL32.DLL			FindClose
KERNEL32.DLL			FindFirstFileA
KERNEL32.DLL			FileTimeToDosDateTime
KERNEL32.DLL			FileTimeToLocalFileTime
KERNEL32.DLL			FindNextFileA
KERNEL32.DLL			CloseHandle
KERNEL32.DLL			GetTempPathA
KERNEL32.DLL			TlsSetValue
KERNEL32.DLL			TlsGetValue
KERNEL32.DLL			LocalAlloc
KERNEL32.DLL			GetModuleHandleA
KERNEL32.DLL			GetModuleFileNameA
KERNEL32.DLL			GetCurrentThreadId
KERNEL32.DLL			DeleteCriticalSection
KERNEL32.DLL			LeaveCriticalSection
KERNEL32.DLL			EnterCriticalSection
KERNEL32.DLL			InitializeCriticalSection
KERNEL32.DLL			VirtualFree
KERNEL32.DLL			VirtualAlloc
KERNEL32.DLL			LocalFree
KERNEL32.DLL			LocalAlloc
KERNEL32.DLL			VirtualQuery
KERNEL32.DLL			lstrlenA
KERNEL32.DLL			lstrcpynA
KERNEL32.DLL			lstrcpyA
KERNEL32.DLL			LoadLibraryExA
KERNEL32.DLL			GetThreadLocale
KERNEL32.DLL			GetStartupInfoA
KERNEL32.DLL			GetProcAddress
KERNEL32.DLL			GetModuleHandleA
KERNEL32.DLL			GetModuleFileNameA
KERNEL32.DLL			GetLocaleInfoA
KERNEL32.DLL			GetLastError
KERNEL32.DLL			GetCommandLineA
KERNEL32.DLL			FreeLibrary
KERNEL32.DLL			FindFirstFileA
KERNEL32.DLL			FindClose
KERNEL32.DLL			CreateDirectoryA
KERNEL32.DLL			ExitProcess
KERNEL32.DLL			WriteFile
KERNEL32.DLL			UnhandledExceptionFilter
KERNEL32.DLL			SetFilePointer
KERNEL32.DLL			SetEndOfFile
KERNEL32.DLL			RtlUnwind
KERNEL32.DLL			ReadFile
KERNEL32.DLL			RaiseException
KERNEL32.DLL			GetStdHandle
KERNEL32.DLL			GetFileSize
KERNEL32.DLL			GetSystemTime
KERNEL32.DLL			GetFileType
KERNEL32.DLL			CreateFileA
KERNEL32.DLL			CloseHandle
advapi32.dll			RegQueryValueExA
advapi32.dll			RegOpenKeyExA
advapi32.dll			RegCloseKey
oleaut32.dll			VariantClear
oleaut32.dll			SysFreeString
user32.dll			GetKeyboardType
user32.dll			MessageBoxA
user32.dll			CharNextA
user32.dll			DispatchMessageA
user32.dll			TranslateMessage
user32.dll			PeekMessageA

show previews

offset	size	type	comment
0	1428992	EXE	06/19/1992 22:22:17	#
15c1	15	HTM		#
46348	434374	BMP	(943 x 459)	#
d3045	13086	BMP	(349 x 296)	#
d6373	17646	BMP	(438 x 314)	#
da873	19198	JPG		#
df383	3176	JPG		#
e0229	13350	BMP	(329 x 302)	#
e3659	22524	JPG		#
e8e67	17646	BMP	(438 x 314)	#
ed367	41375	JPG		#
f7517	4317	JPG		#
f8825	13130	BMP	(349 x 297)	#
fbb7f	17646	BMP	(438 x 314)	#
10007f	15443	JPG		#
103ce3	2556	JPG		#
104915	14894	BMP	(368 x 309)	#
108352	26942	BMP	(879 x 240)	#
10ec9f	18902	BMP	(460 x 314)	#
113687	22715	JPG		#
118f53	4562	JPG		#
11a131	46006	BMP	(205 x 216)	#
138f51	6308	JPG		#
13a806	29702	BMP	(602 x 390)	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x74bc