filename | rsc32.exe | |
---|---|---|
size | 240640 (0x3ac00) | |
md5 | d3b37b55a01739a8c4dc58df96603fae | |
type | PE32 executable (console) Intel 80386, for MS Windows, UPX compressed | |
mimetype | application/x-dosexec | |
clamav | OK | |
virustotal | → scan with virustotal.com | |
histogram |
MZ Header
signature | MZ |
bytes_in_last_block | 0x50 |
blocks_in_file | 2 |
num_relocs | 0 |
header_paragraphs | 4 |
min_extra_paragraphs | 0xf |
max_extra_paragraphs | 0xffff |
ss | 0 |
sp | 0xb8 |
checksum | 0 |
ip | 0 |
cs | 0 |
reloc_table_offset | 0x40 |
overlay_number | 0x1a |
reserved0 | 0 |
oem_id | 0 |
oem_info | 0 |
reserved2 | 0 |
reserved3 | 0 |
reserved4 | 0 |
reserved5 | 0 |
reserved6 | 0 |
lfanew | 0x100 |
DOS stub
00000000: ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 |........!..L.!..| 00000010: 50 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 |Program must be | 00000020: 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d |run under Win32.| 00000030: 0a 24 dd 41 8c 24 00 37 00 00 00 00 00 00 00 00 |.$.A.$.7........| 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 000000c0:
PE Header
Packer / Compiler
This file is packed with UPX. Analysis will be incomplete without unpacking. |
Sections
name | va | vsize | raw size | flags | |
---|---|---|---|---|---|
UPX0 | 0x1000 | 0x535000 | 0 | RWX UDATA | |
UPX1 | 0x536000 | 0x3b000 | 0x3a400 | RWX IDATA | |
.rsrc | 0x571000 | 0x1000 | 0x400 | RW- IDATA |
Data Directory
type | va | size | |
---|---|---|---|
EXPORT | 0 | 0 | |
IMPORT | 0x571218 | 0x18c | |
RESOURCE | 0x571000 | 0x218 | |
EXCEPTION | 0 | 0 | |
SECURITY | 0 | 0 | |
BASERELOC | 0 | 0 | |
DEBUG | 0 | 0 | |
ARCHITECTURE | 0 | 0 | |
GLOBALPTR | 0 | 0 | |
TLS | 0x570378 | 0x18 | |
LOAD_CONFIG | 0 | 0 | |
Bound_IAT | 0 | 0 | |
IAT | 0 | 0 | |
Delay_IAT | 0 | 0 | |
CLR_Header | 0 | 0 |
TLS
raw start | raw end | index | callbks | zero fill | flags | |
---|---|---|---|---|---|---|
0x970390 | 0x97039c | 0x47f0ec | 0 | 0 | 0 |
type | name | size | cp | |
---|---|---|---|---|
STRING | #4090 | 460 | 0 | |
STRING | #4091 | 424 | 0 | |
STRING | #4092 | 236 | 0 | |
STRING | #4093 | 484 | 0 | |
STRING | #4094 | 1012 | 0 | |
STRING | #4095 | 832 | 0 | |
STRING | #4096 | 704 | 0 | |
RCDATA | DVCLAL | 16 | 0 | |
RCDATA | PACKAGEINFO | 456 | 0 |
id | lang | string |
---|---|---|
65424 | 0 | bb b9 57 15 51 65 44 18 cf 39 76 0a 93 e2 28 ee |..W.QeD..9v...(.| 8b 41 62 71 d3 35 25 de e6 1d 40 4d ac 5c 61 83 |.Abq.5%...@M.\a.| 06 83 63 2d d1 32 10 4e 95 be 9a 27 4f aa 61 40 |..c-.2.N...'O.a@| 17 6a 20 24 df 5b 42 4f 9a 19 55 ac 1b 60 f4 9f |.j $.[BO..U..`..| b2 37 0c 8d 98 ec df cf ca ee 17 f8 3c 71 73 3e |.7.......... |
65440 | 0 | f8 9d 9d 79 3b 79 1b 0b f5 02 fd 07 cd d1 f0 e1 |...y;y..........| 8f 33 94 11 09 4c 33 0b 3c 93 10 ea bc 02 f5 80 |.3...L3.<.......| 73 e8 0d 87 89 90 de da ca c4 ba 97 4b cd 79 91 |s...........K.y.| e8 70 a1 74 3e 1a 67 c5 37 0c 85 eb 74 02 13 cc |.p.t>.g.7...t...| 1a 4d 5d 09 64 39 12 95 e4 31 9c 5e 0e 52 e0 d2 |.M].d9...1.^.R..| 6f af db 57 ce 41 78 46 0b 16 40 1d dc 5e 89 09 |o..W.AxF..@..^..| 38 d6 fb fe db 14 3e f4 e0 75 5c f7 2b f6 bf 20 |8.....>..u\.+.. | 78 9a 87 c9 f7 d7 b3 03 a4 37 47 c9 17 e0 81 d2 |x........7G.....| 2c 97 30 b6 6c 88 3e 7f 62 14 3c 6d 12 61 d4 ec |,.0.l.>.b. |
65456 | 0 | f8 f5 e7 8b 7a de dd 03 0c ce 4b 9c d8 a6 71 d0 |....z.....K...q.| 1e f4 b1 6b c4 b0 e4 86 73 5a b5 5d aa 17 bf cd |...k....sZ.]....| b9 21 13 40 55 38 c7 2b e6 5d 19 77 99 72 53 47 |.!.@U8.+.].w.rSG| d8 d9 90 c6 8f 13 37 6b 4b ce 3e 70 b5 86 20 ff |......7kK.>p.. .| 28 63 f9 93 a0 5d ee 21 6d e5 e6 97 01 56 1b e9 |(c...].!m....V..| c4 69 e1 d5 83 86 b6 c1 34 88 c7 31 7d b3 23 98 |.i......4..1}.#.| 9a 17 c0 e9 a9 91 b4 c2 f1 c9 8e ad 77 75 a8 8e |............wu..| 9f c0 4a 33 e9 92 e0 1d b0 46 33 05 5a 46 f3 f0 |..J3.....F3.ZF..| ad 3b e5 9e da 6d bb 70 ad d8 77 2c 40 1d 6a 5c |.;...m.p..w,@.j\| 46 02 05 ca ab a2 23 b0 f0 ff 3d 09 c3 61 43 ec |F.....#...=..aC.| fb 7d d0 9e cd c5 62 26 b2 20 60 16 b7 5e 40 91 |.}....b&. `..^@.| df ec d0 7d 1a 55 67 dd 51 dd 53 71 66 57 69 93 |...}.Ug.Q.SqfWi.| 2f 9b be 51 3b e4 ff 30 cc f4 96 72 c8 73 0d 0b |/..Q;..0...r.s..| 88 62 9d 89 aa f3 8c 23 29 28 46 86 6c 80 fc b2 |.b.....#)(F.l...| 51 31 a2 de f7 b9 38 cc f1 4e ce fd |Q1....8..N.. | |
65472 | 0 | 04 4e b7 ee f0 f2 2b 67 36 be 3f ab 9a 90 13 6e |.N....+g6.?....n| 4b 6e 3c 96 f7 e4 df dd d1 f9 02 3e b1 a3 d8 78 |Kn<........>...x| 26 85 79 b7 92 e4 72 ba b6 37 27 00 3e 47 a6 7d |&.y...r..7'.>G.}| da ea 0d fe 50 56 c4 3a 4a ed 2e 3d 24 a5 67 2e |....PV.:J..=$.g.| 81 05 ce 8d 6d 50 b3 f7 35 15 3c 02 06 3d 27 0e |....mP..5.<..='.| f1 8e 2c 03 41 a9 b1 49 f8 1d fd 79 ea bd 86 ae |..,.A..I...y....| 77 b1 13 90 4a 71 b7 48 74 ff 14 42 43 96 82 b2 |w...Jq.Ht..BC...| 36 7e 95 cb 16 7d a4 f8 29 d5 b3 9c a9 d4 71 19 |6~...}..).....q.| 61 d0 e7 23 c6 95 44 6b c5 22 1e 83 71 44 f0 4a |a..#..Dk."..qD.J| c3 0d 83 f6 22 a0 a2 98 9f 6a 85 9c b7 41 85 e6 |...."....j...A..| 0f df 36 af bc 9a 11 2a 4d 51 9e 24 a0 ad 5a d5 |..6....*MQ.$..Z.| 94 05 78 77 0d 70 ae f4 c4 b1 34 13 40 df bd fd |..xw.p....4.@...| 82 2f b0 c4 13 bf 0f a7 ef 7a 50 80 89 36 12 de |./.......zP..6..| 19 41 0e 16 40 10 97 3a 52 be 75 bd 6e 55 39 0f |.A..@..:R.u.nU9.| cb d0 5c eb d2 70 f7 e1 72 3e 30 b8 9a eb 3c 9e |..\..p..r>0...<.| 1a ff 2c 1e 58 aa fe 27 6f 5b 1f 79 85 87 99 a0 |..,.X..'o[.y....| ee 21 9f fa 85 44 2f 5e c5 f6 69 f7 a0 95 d7 1c |.!...D/^..i.....| c1 d5 1f ae 2b dc 48 d7 cc 83 bf fe 4e 56 12 2e |....+.H.....NV..| ad 39 15 81 f0 fc f5 89 11 a7 83 b3 2b 28 06 0e |.9..........+(..| 62 57 9a f2 95 0e 44 e4 cd 72 7a b0 d8 c0 36 c4 |bW....D..rz...6.| da a0 18 55 24 6a 7c 2e 77 e2 7c a0 b1 e4 10 69 |...U$j|.w.|....i| db 97 38 31 39 0f 24 f8 24 ad 8f a2 49 da d3 46 |..819.$.$...I..F| 0f ac 43 79 ef 02 02 94 69 ae 45 af a6 c7 78 0c |..Cy....i.E...x.| bd ae 46 dc 16 a6 a8 49 f7 c7 dc 59 61 39 5d b4 |..F....I...Ya9].| 9e ee f1 fb e8 d4 70 48 c1 16 32 34 6c e1 7f ed |......pH..24l...| 6e 7d 99 a9 1f cc f4 b7 72 ed b4 10 fe c6 ba d3 |n}......r.......| da 3d 86 88 7e 97 b4 1a a0 c6 8e bb a7 ad fe 47 |.=..~..........G| ad f7 7a fb 99 14 c3 ce e0 db 8e 53 7d f1 a8 d2 |..z........S}...| 50 9e cb a4 d2 9a 38 e6 1b 9c 5e 46 d6 c6 af 70 |P.....8...^F...p| fc db c5 43 f9 df ed 1c ea 61 d8 89 17 01 ab bb |...C.....a......| 54 a8 0d 68 |T..h | |
65488 | 0 | 37 a8 72 21 ee 71 d8 95 0d 3e 9e 08 76 10 ea 79 |7.r!.q...>..v..y| 56 e6 02 dc 54 67 41 0b ca d1 0b 56 71 76 6d 92 |V...TgA....Vqvm.| 9b df 80 4e ea 3b 18 74 72 5c 89 90 57 08 5f f9 |...N.;.tr\..W._.| 17 a9 8b 54 06 90 33 3a f1 16 eb 40 91 87 5d 16 |...T..3:...@..].| 6a a1 88 39 df 03 4a e1 ef 2a 95 0e 44 e7 51 6b |j..9..J..*..D.Qk| 5e 82 65 b8 ae 29 aa f3 a4 af 23 66 fd 76 ac 07 |^.e..)....#f.v..| f7 84 b8 4c af b2 77 b3 e8 05 f0 cb 98 db 05 10 |...L..w.........| 8e ac c9 f4 22 27 a3 54 75 2f 78 e3 1d 74 56 3c |...."'.Tu/x..tV<| b8 04 22 c2 d1 47 cb 40 a5 fa cb 39 4a 42 40 e7 |.."..G.@...9JB@.| ca 2e c5 34 99 af 52 b7 f5 2f 7a 29 a2 21 e7 41 |...4..R../z).!.A| 4d b6 ce c8 0b 5e bf ab 35 e3 f8 b8 a6 fc d8 46 |M....^..5......F| 21 5e 93 ae fb 8d e3 b7 c4 1c 61 61 31 30 8d 51 |!^........aa10.Q| 18 41 fa 96 90 37 49 62 aa 51 83 c1 e0 39 e2 0f |.A...7Ib.Q...9..| 8c dc 5c f3 b2 40 3a d2 11 76 f9 84 e0 66 19 3e |..\..@:..v...f.>| 50 7a 47 88 0e 6b 69 06 cd 04 fa df 4e 18 b0 27 |PzG..ki.....N..'| c7 64 40 66 41 5e cc 39 0a c4 a6 6e f1 64 d0 6a |.d@fA^.9...n.d.j| 34 83 39 6b 8a a8 80 91 cb 18 d8 b6 63 d3 00 cf |4.9k........c...| 13 ec 4c c2 85 e2 d4 b9 8e 8e c6 ea 0a c7 7f cf |..L.............| 9a c3 21 b8 d6 0c c7 76 f1 66 00 bd 16 db 64 55 |..!....v.f....dU| 56 27 35 6f cd c3 7a 59 5a fe fa 65 20 fa 45 97 |V'5o..zYZ..e .E.| d7 47 98 bc 37 85 ff 3b 30 24 cf 26 25 23 59 0f |.G..7..;0$.&%#Y.| 18 c6 e1 8c 66 e0 62 3d 56 c4 ec c8 c4 38 52 6f |....f.b=V....8Ro| 96 50 eb 13 4a 68 5d 8a b2 00 31 ca 7b b0 40 15 |.P..Jh]...1.{.@.| a1 0c 10 e6 ba db f8 8b bc 30 70 36 65 e9 85 6a |.........0p6e..j| 77 59 b7 96 06 e3 98 00 09 06 ae 8c 4d 1d e5 5b |wY..........M..[| f6 e7 22 1f 9b 0e 5a 51 22 33 da 4b 41 60 4c 23 |.."...ZQ"3.KA`L#| 2a a4 60 8b e4 32 50 67 2f 17 3c 55 fc 22 3c d3 |*.`..2Pg/. |
65504 | 0 | 47 fc 23 1f 61 02 b0 a0 a2 75 fd f3 ad cf 2c 85 |G.#.a....u....,.| 54 d2 eb dd e5 03 ee 34 ca 20 41 02 60 bc cf fd |T......4. A.`...| 14 e0 91 ea ec 59 7c b6 93 62 df 31 aa da 75 f4 |.....Y|..b.1..u.| 35 45 58 d8 81 d7 50 b8 2a 98 95 b3 a2 df e1 a7 |5EX...P.*.......| 65 20 e6 c7 e9 c8 e4 8f f0 91 aa c4 5b 5f bc 46 |e ..........[_.F| 3f 93 a9 02 3f 96 4c 82 74 54 7e 47 9d 30 f8 ae |?...?.L.tT~G.0..| ab bb f9 6f 50 15 d2 22 5f 24 8c 06 50 56 94 0b |...oP.."_$..PV..| 7c 7c 0e 1c 25 93 c5 6c 2c 2f 36 a9 31 7d 19 fc |||..%..l,/6.1}..| e9 5d c9 e5 f9 99 18 09 33 7d c0 d0 c4 e8 c9 ca |.]......3}......| b3 42 4f 85 e9 5d 9c 2a 57 03 84 1d fb cc c0 05 |.BO..].*W.......| d5 3f 5c f9 2a 20 c8 ab a4 71 3f 18 5f c3 0f 5d |.?\.* ...q?._..]| aa 2c bb a4 d1 b6 15 5a 4a 68 9a 0d 3e 6e 85 a4 |.,.....ZJh..>n..| 1c 8c cc 79 28 46 94 a1 53 20 f4 c8 c6 7a bc bf |...y(F..S ...z..| f1 81 c3 31 dc 4e 53 58 a2 d2 3d a0 c6 e7 fe 4a |...1.NSX..=....J| fb 1c 2a 61 5a 2b f1 a3 54 aa 84 0f a5 ae 2c 23 |..*aZ+..T.....,#| 8c 46 d6 27 5d b3 b6 27 7a 16 c9 f5 17 93 58 41 |.F.']..'z.....XA| c9 a6 f5 b5 c6 ce 78 36 b9 ea 09 c2 f9 5c 94 9f |......x6.....\..| eb a6 21 6c 45 7d 0a b1 34 64 8e 04 28 b4 e7 37 |..!lE}..4d..(..7| 03 0f 8a 3a 0e 75 6a 64 db eb 9c 8a f9 9f 9d bd |...:.ujd........| a9 76 0c 88 98 48 c1 42 37 31 de e2 0f de f3 da |.v...H.B71......| 4b 04 c4 74 c0 16 ca 4b ae 2b ed c9 e2 92 1f 1d |K..t...K.+......| ba f3 0c 64 48 c4 00 09 52 f8 a9 c2 ea 8f 15 81 |...dH...R.......| 45 70 bf 77 7a ce 01 d8 01 bf 83 5e 0f 19 f5 64 |Ep.wz......^...d| c9 30 9a 50 05 4a 41 e0 35 fc 8e 0a 2c 81 7a 26 |.0.P.JA.5...,.z&| 8a 35 c0 c1 a4 91 d3 a5 4b 23 1f f8 9d 76 15 80 |.5......K#...v..| 8e de 19 f7 76 d4 68 4c 47 42 de 7f 3f e9 2c d3 |....v.hLGB..?.,.| f0 19 7e ec 00 78 1f f7 97 eb 91 b7 11 df 52 1d |..~..x........R.| 6d d8 b7 c2 b7 de 2b 96 0a 14 df e6 cc bb c4 4f |m.....+........O| b6 4f 5e 26 03 69 3e 18 f6 de 59 3d 15 2d 7b 1c |.O^&.i>...Y=.-{.| 62 95 bb 6a 5a 34 7e 7f e7 18 33 7d 50 7b 6a 9e |b..jZ4~...3}P{j.| 78 f2 9c a6 34 d7 d9 ec ed d6 30 f0 45 1c 9f 2d |x...4.....0.E..-| d0 32 e7 63 a3 4a d4 72 37 e9 d0 82 40 3c 3d 65 |.2.c.J.r7...@<=e| 5d 1a 29 cb 10 59 d7 0a c0 d8 69 14 ea 01 77 c2 |].)..Y....i...w.| 09 f8 a8 36 b4 ef 1d 8b ad 62 c8 58 21 a1 41 28 |...6.....b.X!.A(| 7b 14 f4 49 13 4a 98 ba 0f e0 b5 13 24 cb 99 0c |{..I.J......$...| 39 1f 96 fe 71 d4 36 23 d8 7f 25 10 06 8e b0 2b |9...q.6#..%....+| a2 a3 b3 2a f5 82 93 ed cc d2 7e 8d 82 ac 70 90 |...*......~...p.| e5 e5 76 23 f9 25 8e 60 3f 9a 10 20 a6 5f 76 a7 |..v#.%.`?.. ._v.| 79 92 ac c2 7a 9c c9 3b 59 11 4b ce 14 a8 f0 1f |y...z..;Y.K.....| 0a 04 6e 7f 10 fb 7d fd 24 f4 21 01 7a b1 22 6b |..n...}.$.!.z."k| 95 47 b5 77 ad e4 1d ed 2a 5a a7 ac f0 c7 34 18 |.G.w....*Z....4.| 61 9d f0 8d 81 bf e5 16 0f f5 5b 32 0e 90 4d 8c |a.........[2..M.| e7 2e f8 95 73 9e eb b1 84 18 96 67 bb 72 5d 98 |....s......g.r].| 36 49 62 03 f2 82 e8 00 f6 c9 d7 d1 a8 20 94 78 |6Ib.......... .x| 25 66 b8 28 12 68 30 95 f2 b6 94 b3 8c 24 24 91 |%f.(.h0......$$.| 6c 5c 7e 8d a7 aa bd bb 97 8e 18 79 d0 52 a0 d8 |l\~........y.R..| ba 91 94 ed a0 12 db 55 c4 c0 30 1f a4 e3 37 96 |.......U..0...7.| f1 6b db 5c c0 52 9f 7c c4 75 9a 6b a7 14 00 ae |.k.\.R.|.u.k....| 79 1d e6 13 ea 45 4f 9c 84 69 d3 45 6b c3 5c 55 |y....EO..i.Ek.\U| 9e 59 dd 1f e7 d4 50 b0 f9 96 c6 de b5 87 15 f1 |.Y....P.........| 4d 50 80 e6 02 16 31 b6 a0 bf 02 fb e1 75 96 ee |MP....1......u..| 58 b0 6a 49 2d 2e 56 52 9a 46 7b 26 61 ae af f6 |X.jI-.VR.F{&a...| |
65520 | 0 | 61 76 e0 ce 99 dd 65 17 c4 c0 68 83 aa 48 d3 90 |av....e...h..H..| 2e 24 7d 24 58 65 8d a2 c8 b1 81 d2 e5 7a e1 05 |.$}$Xe.......z..| c7 42 5a 1c 13 39 7b bf 3b 9e 0e 58 b0 ff 2c 43 |.BZ..9{.;..X..,C| 9a 0e 9e 04 3b 72 d8 4f f3 43 20 1f b9 4f 5f 03 |....;r.O.C ..O_.| f5 56 12 37 87 03 a0 bd dc a3 4e f3 65 9a 09 e3 |.V.7......N.e...| 05 b9 66 1c d6 b0 ce 0e 25 69 73 b5 2d fc f4 79 |..f.....%is.-..y| e9 bd b8 cb 6c ca 97 89 f8 27 aa e9 12 76 0d fd |....l....'...v..| 48 04 97 d5 fd 5c b3 cc 7f 3c cf 8d b2 d3 25 49 |H....\...<....%I| 9c 5f 54 8c 8b e6 bd 72 ae 67 f7 9b c2 a2 ef 17 |._T....r.g......| 48 19 39 d2 d5 bf 41 2f 3c 67 eb fb 18 d2 8b 88 |H.9...A/ |
module_name | hint | ord | function_name |
---|---|---|---|
KERNEL32.DLL | LoadLibraryA | ||
KERNEL32.DLL | GetProcAddress | ||
KERNEL32.DLL | VirtualProtect | ||
KERNEL32.DLL | VirtualAlloc | ||
KERNEL32.DLL | VirtualFree | ||
KERNEL32.DLL | ExitProcess | ||
advapi32.dll | RegCloseKey | ||
oleaut32.dll | VariantCopy | ||
RSC32_FFTW3.DLL | fftw_destroy_plan | ||
user32.dll | CharNextA |
Please donate some bucks to keep this site up and running: | |
Ko-fi | |
---|---|
Yandex.Money | |
Thank you! |
[!] string size(95094) > stringtable size(460). truncated to 458
[!] cannot convert "W\x15QeD\x18\xCF9v\n\x93\xE2(\xEE\x8BA"... to UTF-16
[!] string size(80880) > stringtable size(424). truncated to 422
[!] cannot convert "\x9Dy;y\e\v\xF5\x02\xFD\a\xCD\xD1\xF0\xE1\x8F3"... to UTF-16
[!] string size(125936) > stringtable size(236). truncated to 234
[!] cannot convert "\xE7\x8Bz\xDE\xDD\x03\f\xCEK\x9C\xD8\xA6q\xD0\x1E\xF4"... to UTF-16
[!] string size(39944) > stringtable size(484). truncated to 482
[!] cannot convert "\xB7\xEE\xF0\xF2+g6\xBE?\xAB\x9A\x90\x13nKn"... to UTF-16
[!] string size(86126) > stringtable size(1012). truncated to 1010
[!] cannot convert "r!\xEEq\xD8\x95\r>\x9E\bv\x10\xEAyV\xE6"... to UTF-16
[!] string size(129166) > stringtable size(832). truncated to 830
[!] cannot convert "#\x1Fa\x02\xB0\xA0\xA2u\xFD\xF3\xAD\xCF,\x85T\xD2"... to UTF-16
[!] string size(60610) > stringtable size(704). truncated to 702
[!] cannot convert "\xE0\xCE\x99\xDDe\x17\xC4\xC0h\x83\xAAH\xD3\x90.$"... to UTF-16
[?] can't find file_offset of VA 0x7f0ec