rohanclient.exe - RohanClient - Rohan Online Game

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	rohanclient.exe
size	10096640 (0x9a1000)
md5	cbe2b10f0ff7b3c0a007167eb203c566

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x9190
blocks_in_file	0x3827
num_relocs	0x59
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x128

Rich Header

lib id	version	times used
105	2067	7
15	3077	67
95	2179	10
93	2067	2
95	3077	247
4	8168	4
4	8447	4
95	2067	12
18	8444	6
29	9178	132
28	9178	4
25	9210	8
1	0	498
93	2179	29
96	3077	1437
94	3052	1
90	3077	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	9
TimeDateStamp	0x4f55b997
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	7.10
SizeOfCode	0
SizeOfInitializedData	0
SizeOfUninitializedData	0
AddressOfEntryPoint	0xb720f6
BaseOfCode	0
BaseOfData	0
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x1000
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0xb77000
SizeOfHeaders	0x1000
CheckSum	0x9afbc9
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x762000	0x762000	RWX CODE
.rdata	0x763000	0xe7000	0xe7000	RW- IDATA
.data	0x84a000	0x16f000	0x22000	RW- IDATA
.rsrc	0x9b9000	0x2000	0x2000	RW- IDATA
.reloc	0x9bb000	0x89000	0	RW- IDATA DISCARDABLE
.sedata	0xa44000	0x130000	0x130000	RWX CODE
.idata	0xb74000	0x1000	0x1000	RW- IDATA
.rsrc	0xb75000	0x1000	0x1000	RW- IDATA
.sedata	0xb76000	0x1000	0x1000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xb74110	0x3c
RESOURCE	0xb75000	0x1000
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
ICON	#1	2216
GROUP_ICON	#102	20
VERSION	#1	712
MANIFEST	#1	648

module_name	ord	function_name
KERNEL32.DLL		TerminateProcess
KERNEL32.DLL	2147483647
ADVAPI32.dll		RegCloseKey
ADVAPI32.dll	2147483647
AVIFIL32.dll		AVIStreamLength
AVIFIL32.dll	2147483647
d3d9.dll		Direct3DCreate9
d3d9.dll	2147483647
dbghelp.dll		MiniDumpWriteDump
dbghelp.dll	2147483647
DINPUT8.dll		DirectInput8Create
DINPUT8.dll	2147483647
dph.ldr		__initialize
dph.ldr	2147483647
fmod.dll		_FSOUND_SetLoopMode@8
fmod.dll	2147483647
GDI32.dll		CreateFontIndirectA
GDI32.dll	2147483647
IMM32.dll		ImmReleaseContext
IMM32.dll	2147483647
iphlpapi.dll		GetAdaptersInfo
iphlpapi.dll	2147483647
LIBEAY32.dll	477
LIBEAY32.dll	2147483647
npkcrypt.dll	2
npkcrypt.dll	2147483647
ole32.dll		CoCreateInstance
ole32.dll	2147483647
OLEAUT32.dll	8
OLEAUT32.dll	2147483647
SHELL32.dll		ShellExecuteExA
SHELL32.dll	2147483647
SHLWAPI.dll		wnsprintfA
SHLWAPI.dll	2147483647
USER32.dll		SetParent
USER32.dll	2147483647
VERSION.dll		VerQueryValueA
VERSION.dll	2147483647
WININET.dll		InternetOpenA
WININET.dll	2147483647
WINMM.dll		mmioWrite
WINMM.dll	2147483647
WS2_32.dll	57
WS2_32.dll	2147483647
MSVCRT.dll		strncpy
MSVCRT.dll	2147483647
PSAPI.DLL		GetMappedFileNameW
PSAPI.DLL	2147483647

StringTable 040904b0

CompanyName	YNK Games
FileDescription	Rohan Online Game
FileVersion	6, 4, 0, 116
InternalName	RohanClient
LegalCopyright	Copyright (C) 2005
OriginalFilename	RohanClient
ProductName	Rohan
ProductVersion	6, 4, 0, 116

VS_FIXEDFILEINFO

FileVersion	6.4.0.116
ProductVersion	6.4.0.116
StrucVersion	0x10000
FileFlagsMask	0x17
FileFlags	0
FileOS	4
FileType	0
FileSubtype	0

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	10091056	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

rohanclient.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

rohanclient.exe
-