| filename | rohanclient.exe | |
|---|---|---|
| size | 2706432 (0x294c00) | |
| md5 | cf5eacf4f9e2bbf3b9ab21e97aca9db5 | |
| type | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed | |
| mimetype | application/x-dosexec | |
| clamav | OK | |
| virustotal | → scan with virustotal.com | |
| histogram | ||
MZ Header
| signature | MZ |
| bytes_in_last_block | 0x9190 |
| blocks_in_file | 0x3827 |
| num_relocs | 0x59 |
| header_paragraphs | 4 |
| min_extra_paragraphs | 0 |
| max_extra_paragraphs | 0xffff |
| ss | 0 |
| sp | 0xb8 |
| checksum | 0 |
| ip | 0 |
| cs | 0 |
| reloc_table_offset | 0x40 |
| overlay_number | 0 |
| reserved0 | 0 |
| oem_id | 0 |
| oem_info | 0 |
| reserved2 | 0 |
| reserved3 | 0 |
| reserved4 | 0 |
| reserved5 | 0 |
| reserved6 | 0 |
| lfanew | 0x138 |
Rich Header
| lib id | version | times used |
|---|---|---|
| 105 | 2067 | 7 |
| 15 | 3077 | 67 |
| 95 | 2179 | 10 |
| 93 | 2067 | 2 |
| 95 | 3077 | 250 |
| 4 | 8168 | 4 |
| 4 | 8447 | 4 |
| 95 | 2067 | 12 |
| 18 | 8444 | 6 |
| 29 | 9178 | 132 |
| 28 | 9178 | 4 |
| 25 | 9210 | 8 |
| 1 | 0 | 510 |
| 93 | 2179 | 29 |
| 96 | 3077 | 1456 |
| 94 | 3052 | 1 |
| 90 | 3077 | 1 |
DOS stub
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th| 00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno| 00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS | 00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
PE Header
Packer / Compiler
UPX v0.89.6 - v1.02 / v1.05 - v1.22 This file is packed with UPX. Analysis will be incomplete without unpacking. |
Sections
| name | va | vsize | raw size | flags | |
|---|---|---|---|---|---|
| UPX0 | 0x1000 | 0x7d8000 | 0 | RWX UDATA | |
| UPX1 | 0x7d9000 | 0x294000 | 0x293200 | RWX IDATA | |
| .rsrc | 0xa6d000 | 0x2000 | 0x1600 | RW- IDATA |
Data Directory
| type | va | size | |
|---|---|---|---|
| EXPORT | 0 | 0 | |
| IMPORT | 0xa6e114 | 0x4d8 | |
| RESOURCE | 0xa6d000 | 0x1114 | |
| EXCEPTION | 0 | 0 | |
| SECURITY | 0 | 0 | |
| BASERELOC | 0 | 0 | |
| DEBUG | 0 | 0 | |
| ARCHITECTURE | 0 | 0 | |
| GLOBALPTR | 0 | 0 | |
| TLS | 0 | 0 | |
| LOAD_CONFIG | 0 | 0 | |
| Bound_IAT | 0 | 0 | |
| IAT | 0 | 0 | |
| Delay_IAT | 0 | 0 | |
| CLR_Header | 0 | 0 |
| type | name | size | cp | |
|---|---|---|---|---|
| ICON | #1 | 2216 | 0 | |
| STRING | #1251 | 52 | 0 | |
| STRING | #1257 | 92 | 0 | |
| STRING | #1263 | 46 | 0 | |
| STRING | #1876 | 86 | 0 | |
| STRING | #1938 | 72 | 0 | |
| STRING | #2007 | 60 | 0 | |
| STRING | #2013 | 106 | 0 | |
| STRING | #2014 | 80 | 0 | |
| STRING | #2019 | 36 | 0 | |
| GROUP_ICON | #102 | 20 | 0 | |
| VERSION | #1 | 712 | 0 | |
| MANIFEST | #1 | 648 | 0 |
| id | lang | string |
|---|---|---|
| 20000 | 1042 | 痤뎳蕀茗⑤湀苝걓聄짛붻뉰ࡈ䛡芆袑ᅌ傠즷䋬붸⭔췐 |
| 20096 | 1042 | 殉⺕灜蠃ꬡ骤悆䑌碈賛ᘰ膌㲸؈Ԭ㑗腱卉焒ႁ䴫夛縖廄蚑慆鄈萊큆뿡Თ騌ƈ ፕ⩱볠虀祺ⴠ |
| 20192 | 1042 | 욐鹗᪙骆䁓놫郖絥礘᫁纠Α䄽냥笅캯ḃ챃 |
| 30000 | 1042 | 3b dd 16 ee 4d 4b c0 98 9f 1c 6e 93 4f 0c 53 db |;...MK....n.O.S.| 83 ff ae 20 93 70 47 28 a0 a0 0f 30 4f 8c f1 a3 |... .pG(...0O...| cb 03 3c 21 ec 1d 57 fc 71 ad 20 ac 4a e0 cb c8 |.. |
| 30992 | 1042 | 80 e6 0e 39 08 05 9e 19 d6 28 4c da 21 6d ac 36 |...9.....(L.!m.6| 10 1c 18 14 6e 83 6d 03 ad 48 18 19 5a f5 1c 36 |....n.m..H..Z..6| c0 64 40 20 61 48 24 5b 56 21 70 22 4f 26 19 36 |.d@ aH$[V!p"O&.6| 56 4d c7 80 c3 59 f8 ef 73 40 c6 86 27 09 b0 43 |VM...Y..s@..'..C| 52 6c 18 08 34 be f6 6d |Rl..4..m | |
| 32096 | 1042 | 01 be ae 71 2c 44 69 f8 17 6c 28 04 18 d7 bb da |...q,Di..l(.....| 90 fc a2 29 c9 75 d2 b9 ba c1 8a 58 e9 ab 01 0e |...).u.....X....| 39 21 ff 45 53 4f 57 a0 01 10 bc bc 46 5b 29 45 |9!.ESOW.....F[)E| d2 32 5d 03 46 25 45 18 9a 3d 08 72 |.2].F%E..=.r | |
| 32192 | 1042 | 驣䋼Č喫Ĥ璍⹋Ⲅ沈優㯃ļ瘰霡氓㐁轔搶렸⒔㰘匊㾃ꘓ诌ᴾ堝萢⭨밮ጵⱈ呐氤历ய池磙㍕Ὥ邢嘟䂾嚥뭠儑 |
| 32208 | 1042 | 16 68 5f 24 cb 80 70 19 8e 20 05 c7 3e b0 70 4c |.h_$..p.. ..>.pL| 73 d9 c9 1d b8 45 bc 5f 69 37 8a d8 a4 3f 5d 33 |s....E._i7...?]3| 45 34 5f 28 78 2c 98 35 4f c0 4f d1 de e0 43 40 |E4_(x,.5O.O...C@| 1f cc 28 1a 9f 2c c6 7c d8 e1 92 d4 db 78 22 44 |..(..,.|.....x"D| 30 27 db 16 52 4f b6 ed 26 99 76 02 d1 f0 84 84 |0'..RO..&.v.....| |
| 32288 | 1042 | eb 78 9e d9 73 30 f0 a7 48 48 34 e0 81 53 58 37 |.x..s0..HH4..SX7| d8 e2 a2 24 22 a3 65 25 ef bc 29 80 bf 38 ca a0 |...$".e%..)..8..| ed 8e f6 9e |.... | |
| module_name | hint | ord | function_name |
|---|---|---|---|
| KERNEL32.DLL | LoadLibraryA | ||
| KERNEL32.DLL | GetProcAddress | ||
| KERNEL32.DLL | VirtualProtect | ||
| KERNEL32.DLL | VirtualAlloc | ||
| KERNEL32.DLL | VirtualFree | ||
| KERNEL32.DLL | ExitProcess | ||
| ADVAPI32.dll | RegOpenKeyA | ||
| AVIFIL32.dll | AVIFileExit | ||
| d3d9.dll | Direct3DCreate9 | ||
| dbghelp.dll | MiniDumpWriteDump | ||
| DINPUT8.dll | DirectInput8Create | ||
| dph.ldr | __initialize | ||
| fmod.dll | _FSOUND_Init@12 | ||
| GDI32.dll | BitBlt | ||
| IMM32.dll | ImmIsIME | ||
| iphlpapi.dll | GetAdaptersInfo | ||
| LIBEAY32.dll | 342 | ||
| npkcrypt.dll | 17 | ||
| ole32.dll | CoInitialize | ||
| OLEAUT32.dll | 6 | ||
| SHELL32.dll | ShellExecuteA | ||
| SHLWAPI.dll | wnsprintfA | ||
| USER32.dll | GetDC | ||
| VERSION.dll | VerQueryValueA | ||
| WININET.dll | FtpPutFileA | ||
| WINMM.dll | mmioSeek | ||
| WS2_32.dll | 6 |
StringTable 040904b0
| CompanyName | YNK Games |
| FileDescription | Rohan Online Game |
| FileVersion | 6, 4, 0, 116 |
| InternalName | RohanClient |
| LegalCopyright | Copyright (C) 2005 |
| OriginalFilename | RohanClient |
| ProductName | Rohan |
| ProductVersion | 6, 4, 0, 116 |
VS_FIXEDFILEINFO
| FileVersion | 6.4.0.116 |
| ProductVersion | 6.4.0.116 |
| StrucVersion | 0x10000 |
| FileFlagsMask | 0x17 |
| FileFlags | 0 |
| FileOS | 4 |
| FileType | 0 |
| FileSubtype | 0 |
 |
| Please donate some bucks to keep this site up and running: | |
| Ko-fi | |
|---|---|
| Yandex.Money | |
| Thank you! | |
[!] string size(75866) > stringtable size(52). truncated to 50
[!] string size(118830) > stringtable size(92). truncated to 90
[!] string size(6338) > stringtable size(46). truncated to 44
[!] string size(113270) > stringtable size(86). truncated to 84
[!] cannot convert "\x16\xEEMK\xC0\x98\x9F\x1Cn\x93O\fS\xDB\x83\xFF"... to UTF-16
[!] string size(118016) > stringtable size(72). truncated to 70
[!] cannot convert "\x0E9\b\x05\x9E\x19\xD6(L\xDA!m\xAC6\x10\x1C"... to UTF-16
[!] string size(97282) > stringtable size(60). truncated to 58
[!] cannot convert "\xAEq,Di\xF8\x17l(\x04\x18\xD7\xBB\xDA\x90\xFC"... to UTF-16
[!] string size(81578) > stringtable size(106). truncated to 104
[!] string size(53292) > stringtable size(80). truncated to 78
[!] cannot convert "_$\xCB\x80p\x19\x8E \x05\xC7>\xB0pLs\xD9"... to UTF-16
[!] string size(61910) > stringtable size(36). truncated to 34
[!] cannot convert "\x9E\xD9s0\xF0\xA7HH4\xE0\x81SX7\xD8\xE2"... to UTF-16