filenameRar.exe
size275968 (0x43600)
md5d567a6d0647f80ecb5a761ddd9ad367c
typePE32 executable (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x50
blocks_in_file2
num_relocs0
header_paragraphs4
min_extra_paragraphs0xf
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0x1a
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x200

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001c0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections7
TimeDateStamp0x3ce100fa
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion5.0
SizeOfCode0x38000
SizeOfInitializedData0xc000
SizeOfUninitializedData0
AddressOfEntryPoint0x1000
BaseOfCode0x1000
BaseOfData0x39000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x4f000
SizeOfHeaders0x600
CheckSum0
Subsystem3
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x2000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Borland C++ for Win32 1999

Sections

namevavsizeraw sizeflags
.text0x10000x380000x37a00R-X CODE
.data0x390000xc0000x4600RW- IDATA
.tls0x450000x10000x200RW- IDATA
.rdata0x460000x10000x200R-- IDATA SHARED
.idata0x470000x10000xc00R-- IDATA
.edata0x480000x10000x200R-- IDATA
.rsrc0x490000x60000x5e00R-- IDATA

Data Directory

typevasize
EXPORT0x480000x67
IMPORT0x470000xb6d
RESOURCE0x490000x5e00
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0x460000x18
LOAD_CONFIG00
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4450000x44509c0x4391470x44601000
typenamesizecp
STRING#1881260
STRING#1894660
STRING#190800
STRING#1915320
STRING#1926720
STRING#1936720
STRING#1947840
STRING#1958160
STRING#1967800
STRING#1977000
STRING#1988360
STRING#1997420
STRING#2007740
STRING#2018600
STRING#2028500
STRING#2036060
STRING#2044140
STRING#2053520
STRING#2063740
STRING#2073700
STRING#2083620
STRING#2094300
STRING#2103800
STRING#2113820
STRING#2123720
STRING#2134040
STRING#2144780
STRING#2154980
STRING#2163940
STRING#2172040
STRING#2185580
STRING#2192680
STRING#2203960
STRING#2214400
STRING#2225760
STRING#2235360
STRING#2246460
STRING#2256440
STRING#2265940
STRING#2274980
STRING#2286360
RCDATADVCLAL160
idlangstring
30021049_Yes_No
30041049_Yes_No_All
30061049_Yes_No_All_nEver_Rename_Quit
30081049_Continue_Quit
30101049_Retry_Abort
30121049 RAR %s Copyright (c) 1993-%d Eugene Roshal %d %s %d
30141049 Registered to %s
30161049 Shareware version Type RAR -? for help
30181049 UNRAR %s freeware Copyright (c) 1993-%d Eugene Roshal
30201049beta
30221049Jan
30241049Feb
30261049Mar
30281049Apr
30301049May
30321049Jun
30341049Jul
30361049Aug
30381049Sep
30401049Oct
30421049Nov
30441049Dec
30461049 Usage: rar <command> -<switch 1> -<switch N> <archive> <files...>
30481049 Usage: unrar <command> -<switch 1> -<switch N> <archive> <files...>
30501049 <@listfiles...> <path_to_extract\>
30521049 <Commands>
30541049 a Add files to archive
30561049 c Add archive comment
30581049 cf Add files comment
30601049 cw Write archive comment to file
30621049 d Delete files from archive
30641049 e Extract files to current directory
30661049 f Freshen files in archive
30681049 k Lock archive
30701049 l[t] List archive [technical]
30721049 m[f] Move to archive [files only]
30741049 p Print file to stdout
30761049 r Repair archive
30781049 rc Reconstruct missing volumes
30801049 rr[N] Add data recovery record
30821049 rv[N] Create recovery volumes
30841049 s[name|-] Convert archive to or from SFX
30861049 t Test archive files
30881049 u Update files in archive
30901049 v[t] Verbosely list archive [technical]
30921049 x Extract files with full path
30941049 <Switches>
30961049 - Stop switches scanning
30981049 ac Clear Archive attribute after compression or extraction
31001049 ad Append archive name to destination path
31021049 ag[format] Generate archive name using the current date
31041049 ao Add files with Archive attribute set
31061049 ap<path> Set path inside archive
31081049 as Synchronize archive contents
31101049 av Put authenticity verification (registered versions only)
31121049 av- Disable authenticity verification check
31141049 c- Disable comments show
31161049 cfg- Disable read configuration
31181049 cl Convert names to lower case
31201049 cu Convert names to upper case
31221049 df Delete files after archiving
31241049 dh Open shared files
31261049 ds Disable name sort for solid archive
31281049 e<attr> Set file exclude attributes
31301049 ed Do not add empty directories
31321049 ee Do not save and extract extended attributes
31341049 en Do not put 'end of archive' block
31361049 ep Exclude paths from names
31381049 ep1 Exclude base directory from names
31401049 ep2 Expand paths to full
31421049 f Freshen files
31441049 hp[password] Encrypt both file data and headers
31461049 idp Disable percentage display
31481049 ieml[addr] Send archive by email
31501049 ierr Send all messages to stderr
31521049 ilog[name] Log errors to file (registered versions only)
31541049 inul Disable all messages
31561049 isnd Enable sound
31581049 k Lock archive
31601049 kb Keep broken extracted files
31621049 m<0..5> Set compression level (0-store...3-default...5-maximal)
31641049 mc<par> Set advanced compression parameters
31661049 md<size> Dictionary size in KB (64,128,256,512,1024,2048,4096 or A-G)
31681049 ms[ext;ext] Specify file types to store
31701049 o+ Overwrite existing files
31721049 o- Do not overwrite existing files
31741049 ol Save symbolic links as the link instead of the file
31761049 os Save NTFS streams
31781049 ow Save or restore file owner and group
31801049 p[password] Set password
31821049 p- Do not query password
31841049 r Recurse subdirectories
31861049 r0 Recurse subdirectories for wildcard names only
31881049 ri<P>[:<S>] Set priority (0-default,1-min..15-max) and sleep time in ms
31901049 rr[N] Add data recovery record
31921049 rv[N] Create recovery volumes
31941049 s[<N>,v[-],e] Create solid archive
31961049 s- Disable solid archiving
31981049 sfx[name] Create SFX archive
32001049 t Test files after archiving
32021049 tk Keep original archive time
32041049 tl Set archive time to latest file
32061049 tn<time> Process files newer than <time>
32081049 to<time> Process files older than <time>
32101049 ta<date> Process files modified after <date> in YYYYMMDDHHMMSS format
32121049 tb<date> Process files modified before <date> in YYYYMMDDHHMMSS format
32141049 u Update files
32161049 v Create volumes with size autodetection or list all volumes
32181049 v<size>[k,b] Create volumes with size=<size>*1000 [*1024, *1]
32201049 vd Erase disk contents before creating volume
32221049 ver[n] File version control
32241049 vn Use the old style volume naming scheme
32261049 vp Pause before each volume
32281049 w<path> Assign work directory
32301049 x<file> Exclude specified file
32321049 x@ Read file names to exclude from stdin
32341049 x@<list> Exclude files in specified list file
32361049 y Assume Yes on all queries
32381049 z<file> Read archive comment from file
32401049 ERROR: Bad archive %s
32421049Enter password (will not be echoed)
32441049Enter password
32461049 Reenter password:
32481049 for
32501049 ERROR: Passwords do not match
32521049Write error in the file %s
32541049Read error in the file %s
32561049Seek error in the file %s
32581049Cannot close the file %s
32601049Not enough memory
32621049Corrupt archive - use 'Repair' command
32641049Program aborted
32661049 Cannot rename %s to %s
32681049 Cannot find volume %s
32701049 User break
32721049 Create next volume ?
32741049 Disk full. Insert next
32761049 Creating %sarchive %s
32781049 Insert disk with %s
32801049 Testing archive %s
32821049 Extracting from %s
32841049 Converting %s
32861049 Convert archives to SFX
32881049 Removing SFX module
32901049 %s is not SFX archive
32921049 %s is not RAR archive
32941049 %s is not the first volume
32961049 %s - cannot convert to SFX archive with old format
32981049 Cannot create %s
33001049 Cannot open %s
33021049 Unknown method in %s
33041049 OK
33061049 Done
33081049 Locking archive
33101049 ERROR: Cannot modify old format archive
33121049 ERROR: Locked archive
33141049 ERROR: Cannot modify volume
33161049 Verifying authenticity information ...
33181049 Failed
33201049 Archive %s
33221049 created at %s
33241049 by %s
33261049Invalid authenticity information
33281049 Adding authenticity verification
33301049 Old style authenticity information
33321049 Evaluation copy. Please register.
33341049 Creating %sarchive %s
33361049 Updating %sarchive %s
33381049solid
33401049 Adding %-58s
33421049 Updating %-58s
33441049 ... %-58s
33461049 ERROR: Cannot update solid archives with password
33481049 Deleting files %s...
33501049and directories
33521049 Deleting %-30s
33541049 deleted
33561049 NOT DELETED
33581049 Clearing attributes...
33601049 Deleting directory %-30s
33621049 WARNING: Cannot open %d %s
33641049files
33661049file
33681049 WARNING: No files
33701049 %s: encrypted
33721049 Cannot modify solid archive containing encrypted files
33741049 Analyzing archived files:
33761049 Repacking archived files:
33781049 %-20s - CRC failed
33801049 Testing archive %s
33821049 Extracting from %s
33841049 %s - use current password ?
33861049 Creating %-56s
33881049 Skipping %-56s
33901049 Testing %-56s
33921049 Extracting %-56s
33941049 ... %-56s
33961049 Cannot create directory %s
33981049 ------ Printing %s
34001049 Encrypted file: CRC failed in %s (password incorrect ?)
34021049 No files to extract
34041049 All OK
34061049 Total errors: %ld
34081049 %s already exists. Overwrite it ?
34101049 Overwrite %s ?
34121049 Enter new name:
34141049 The archive header is corrupt
34161049 %s - the file header is corrupt
34181049 The comment header is corrupt
34201049The data recovery header is corrupt
34221049 Reading comment from stdin
34241049 Reading comment from %s
34261049 Deleting comment from %s
34281049 Adding comment to %s
34301049 Adding file comments
34321049 Reading comment for %s : %s from stdin
34341049 The archive comment is corrupt
34361049 Press 'Enter' to continue or 'Q' to quit:
34381049 The file comment is corrupt
34401049 Destination file name required
34421049 Write comment to %s
34441049 Comment is not present
34461049 Deleting from %s
34481049 Deleting %s
34501049 Erasing empty archive %s
34521049 No files to delete
34541049 -------- %2d %s %d, archive %s
34561049 ERROR: Path too long
34581049Solid
34601049SFX
34621049volume
34641049Volume
34661049archive
34681049Archive
34701049 Recovery record is present
34721049 Lock is present
34741049 Pathname/Comment
34761049 Name
34781049 Size Packed Ratio Date Time Attr CRC Meth Ver
34801049 Host OS Solid Old
34821049 OS/2 extended attributes
34841049 Unix Owner/Group data: %-14s %-14s
34861049 BeOS extended attributes
34881049 NTFS security data
34901049 NTFS stream: %s
34921049 Unknown subheader type: 0x%04x
34941049 Comment:
34961049Yes
34981049No
35001049 0 files
35021049 Reconstructing %s
35041049 Building %s
35061049 Cannot repair archive with old format
35081049 Found %s
35101049 The archive header is corrupt. Mark archive as solid ?
35121049 No files found
35141049 Suspicious entry %s
35161049 Directory
35181049 Size %ld Packed %ld
35201049 Add it to archive ?
35221049 Unexpected end of archive
35241049 Reconstruct archive structure ?
35261049 Scanning...
35281049 Data recovery record not found
35301049 Data recovery record found
35321049 Sector %ld (offsets %lX...%lX) damaged
35341049 - data recovered
35361049 - cannot recover data
35381049 Adding data recovery record
35401049 Erasing contents of drive %c:
35421049 WARNING: Cannot get %s owner and group
35441049 WARNING: Cannot get owner %s ID
35461049 WARNING: Cannot get group %s ID
35481049 ERROR: %s group and owner data are corrupt
35501049 WARNING: Cannot set %s owner and group
35521049 WARNING: Cannot read symbolic link %s
35541049 WARNING: Cannot create link %s
35561049 WARNING: Symbolic link %s already exists
35581049 Cannot create %s. Retry ?
35601049 MacOS file type: %c%c%c%c ;
35621049file creator: %c%c%c%c
35641049 %-20s : packed data CRC failed in volume %s
35661049 %s is read-only
35681049 WARNING: Cannot get %s security data
35701049 WARNING: Cannot set %s security data
35721049 ERROR: %s security data are corrupt
35741049 WARNING: Unknown format of %s security data
35761049 ERROR: %s stream data are corrupt
35781049 WARNING: Unknown format of %s stream data
35801049 ERROR: Invalid file name %s
35821049 ERROR: %s extended attributes are corrupt
35841049 WARNING: %s - unknown format of extended attributes
35861049 WARNING: cannot set extended attributes to %s
35881049 ERROR: Cannot get extended attributes of %s
35901049 (+EA)
35921049 ...skipping extended attributes
35941049 Processing archive %s
35961049 File search errors, cannot synchronize archive
35981049 WARNING: Attempting to correct the invalid file name
36001049 WARNING: You need to start extraction from a previous volume to unpack %s
36021049 ERROR: Unknown option: %s
36041049 ERROR: Corrupt data header found, ignored
36061049 WARNING: Unknown data header format, ignored
36081049 ERROR: Corrupt %s data block
36101049 Data header type: %s
36121049 Cannot read contents of %s
36141049 %s is not volume
36161049 ERROR: %s and %s belong to different sets
36181049 %d volumes missing
36201049 %d recovery volumes found
36221049 Nothing to reconstruct
36241049 Reconstruction impossible
36261049 Reconstructing...
36281049 Creating %s
36301049 Write error: only NTFS file system supports files larger than 4 GB
36321049 WARNING: Cannot change attributes of %s
36341049 ERROR: default SFX module does not support RAR %d.%d archives
36361049 Cannot encrypt archive already contained encrypted files
36381049 RAR SFX archive
36401049 <Commands>
36421049 -x Extract from archive (default)
36441049 -t Test archive files
36461049 -v Verbosely list contents of archive
module_namehintordfunction_name
ADVAPI32.DLLAdjustTokenPrivileges
ADVAPI32.DLLGetFileSecurityA
ADVAPI32.DLLGetFileSecurityW
ADVAPI32.DLLGetSecurityDescriptorLength
ADVAPI32.DLLLookupPrivilegeValueA
ADVAPI32.DLLOpenProcessToken
ADVAPI32.DLLSetFileSecurityA
ADVAPI32.DLLSetFileSecurityW
KERNEL32.DLLBackupRead
KERNEL32.DLLBackupSeek
KERNEL32.DLLCloseHandle
KERNEL32.DLLCompareStringA
KERNEL32.DLLCompareStringW
KERNEL32.DLLCreateDirectoryA
KERNEL32.DLLCreateDirectoryW
KERNEL32.DLLCreateFileA
KERNEL32.DLLCreateFileW
KERNEL32.DLLDeleteFileA
KERNEL32.DLLDeleteFileW
KERNEL32.DLLDosDateTimeToFileTime
KERNEL32.DLLExitProcess
KERNEL32.DLLFileTimeToDosDateTime
KERNEL32.DLLFileTimeToLocalFileTime
KERNEL32.DLLFindClose
KERNEL32.DLLFindFirstFileA
KERNEL32.DLLFindFirstFileW
KERNEL32.DLLFindNextFileA
KERNEL32.DLLFindNextFileW
KERNEL32.DLLFlushFileBuffers
KERNEL32.DLLFreeLibrary
KERNEL32.DLLGetACP
KERNEL32.DLLGetCPInfo
KERNEL32.DLLGetCommandLineA
KERNEL32.DLLGetConsoleMode
KERNEL32.DLLGetCurrentDirectoryA
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLGetCurrentThread
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLGetDiskFreeSpaceA
KERNEL32.DLLGetDriveTypeA
KERNEL32.DLLGetEnvironmentStrings
KERNEL32.DLLGetFileAttributesA
KERNEL32.DLLGetFileAttributesW
KERNEL32.DLLGetFileTime
KERNEL32.DLLGetFileType
KERNEL32.DLLGetFullPathNameA
KERNEL32.DLLGetFullPathNameW
KERNEL32.DLLGetLastError
KERNEL32.DLLGetLocalTime
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLGetOEMCP
KERNEL32.DLLGetProcAddress
KERNEL32.DLLGetProcessHeap
KERNEL32.DLLGetStartupInfoA
KERNEL32.DLLGetStdHandle
KERNEL32.DLLGetStringTypeW
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLGetTickCount
KERNEL32.DLLGetVersion
KERNEL32.DLLGetVersionExA
KERNEL32.DLLGlobalMemoryStatus
KERNEL32.DLLHeapAlloc
KERNEL32.DLLHeapFree
KERNEL32.DLLIsDBCSLeadByte
KERNEL32.DLLLCMapStringA
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLLocalFileTimeToFileTime
KERNEL32.DLLMoveFileA
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLRaiseException
KERNEL32.DLLReadConsoleA
KERNEL32.DLLReadFile
KERNEL32.DLLRemoveDirectoryA
KERNEL32.DLLRtlUnwind
KERNEL32.DLLSetConsoleCtrlHandler
KERNEL32.DLLSetConsoleMode
KERNEL32.DLLSetCurrentDirectoryA
KERNEL32.DLLSetEndOfFile
KERNEL32.DLLSetErrorMode
KERNEL32.DLLSetFileAttributesA
KERNEL32.DLLSetFileAttributesW
KERNEL32.DLLSetFilePointer
KERNEL32.DLLSetFileTime
KERNEL32.DLLSetHandleCount
KERNEL32.DLLSetPriorityClass
KERNEL32.DLLSetThreadPriority
KERNEL32.DLLSleep
KERNEL32.DLLTlsAlloc
KERNEL32.DLLTlsFree
KERNEL32.DLLTlsGetValue
KERNEL32.DLLTlsSetValue
KERNEL32.DLLUnhandledExceptionFilter
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLVirtualFree
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLWriteFile
USER32.DLLCharLowerA
USER32.DLLCharLowerW
USER32.DLLCharToOemA
USER32.DLLCharToOemBuffA
USER32.DLLCharUpperA
USER32.DLLCharUpperW
USER32.DLLEnumThreadWindows
USER32.DLLLoadStringA
USER32.DLLMessageBoxA
USER32.DLLOemToCharA
USER32.DLLOemToCharBuffA
USER32.DLLwsprintfA
ordentry_vafunction_name
10x1059__GetExceptDLLinfo
20x39154___CPPdebugHook
module_namerar.exe
flags0
timestamp0
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x48030
Functions(2)0x48028
NameOrdinals(2)0x48038
offsetsizetypecomment
0275968EXE05/14/2002 12:20:10#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK