rarreg.exe

info
MZ
PE
imports
foremost
hexdump
disasm
log
discuss
donate

filename	rarreg.exe
size	444928 (0x6ca00)
md5	e1c8d6ff2cadd2d425bfe3bc138c4bf3

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	scan pending
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xf0

Rich Header

lib id	version	times used
259	26715	10
261	26715	138
260	26715	18
261	28117	38
260	28117	17
259	28117	19
257	26715	7
1	0	101
0	0	2
258	28316	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x64456563
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x122
Magic	0x10b
LinkerVersion	14.24
SizeOfCode	0x39600
SizeOfInitializedData	0x33c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x2aeb7
BaseOfCode	0x1000
BaseOfData	0x3b000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.0
ImageVersion	0.0
SubsystemVersion	6.0
Reserved1	0
SizeOfImage	0x70000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x394ab	0x39600	R-X CODE
.rdata	0x3b000	0x2f9a8	0x2fa00	R-- IDATA
.data	0x6b000	0x1454	0xa00	RW- IDATA
.reloc	0x6d000	0x2b4c	0x2c00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x6a114	0x50
RESOURCE	0	0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x6d000	0x2b4c
DEBUG	0x68790	0x54
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0x6888c	0x18
LOAD_CONFIG	0x687e8	0x40
Bound_IAT	0	0
IAT	0x3b000	0x16c
Delay_IAT	0	0
CLR_Header	0	0

TLS

raw start	raw end	index	callbks	zero fill	flags
0x468e98	0x468e99	0x46ba24	0x43b1a0	0	0x100000

module_name	hint	function_name
bcrypt.dll	29	BCryptGenRandom
ADVAPI32.dll	803	SystemFunction036
KERNEL32.dll	203	CreateFileW
KERNEL32.dll	1453	UnhandledExceptionFilter
KERNEL32.dll	841	HeapFree
KERNEL32.dll	844	HeapReAlloc
KERNEL32.dll	692	GetProcessHeap
KERNEL32.dll	837	HeapAlloc
KERNEL32.dll	1441	TlsSetValue
KERNEL32.dll	1440	TlsGetValue
KERNEL32.dll	19	AddVectoredExceptionHandler
KERNEL32.dll	1377	SetThreadStackGuarantee
KERNEL32.dll	609	GetLastError
KERNEL32.dll	539	GetCurrentThread
KERNEL32.dll	471	GetCommandLineW
KERNEL32.dll	1330	SetLastError
KERNEL32.dll	628	GetModuleFileNameW
KERNEL32.dll		AcquireSRWLockExclusive
KERNEL32.dll	1202	ReleaseSRWLockExclusive
KERNEL32.dll	629	GetModuleHandleA
KERNEL32.dll	686	GetProcAddress
KERNEL32.dll	134	CloseHandle
KERNEL32.dll	855	InitOnceBeginInitialize
KERNEL32.dll	1438	TlsAlloc
KERNEL32.dll	856	InitOnceComplete
KERNEL32.dll	1439	TlsFree
KERNEL32.dll	1445	TryAcquireSRWLockExclusive
KERNEL32.dll	722	GetStdHandle
KERNEL32.dll	508	GetConsoleMode
KERNEL32.dll	1495	WaitForSingleObject
KERNEL32.dll	1007	MultiByteToWideChar
KERNEL32.dll	1553	WriteConsoleW
KERNEL32.dll	1496	WaitForSingleObjectEx
KERNEL32.dll	961	LoadLibraryA
KERNEL32.dll	535	GetCurrentProcess
KERNEL32.dll	215	CreateMutexA
KERNEL32.dll	1200	ReleaseMutex
KERNEL32.dll	632	GetModuleHandleW
KERNEL32.dll	423	FormatMessageW
KERNEL32.dll	569	GetEnvironmentVariableW
KERNEL32.dll	350	ExitProcess
KERNEL32.dll	529	GetCurrentDirectoryW
KERNEL32.dll	1230	RtlCaptureContext
KERNEL32.dll	1	AcquireSRWLockShared
KERNEL32.dll	1203	ReleaseSRWLockShared
KERNEL32.dll	1101	QueryPerformanceCounter
KERNEL32.dll	536	GetCurrentProcessId
KERNEL32.dll	540	GetCurrentThreadId
KERNEL32.dll	745	GetSystemTimeAsFileTime
KERNEL32.dll	867	InitializeSListHead
KERNEL32.dll	895	IsDebuggerPresent
KERNEL32.dll	265	DecodePointer
KERNEL32.dll	1389	SetUnhandledExceptionFilter
KERNEL32.dll	720	GetStartupInfoW
KERNEL32.dll	902	IsProcessorFeaturePresent
KERNEL32.dll	1420	TerminateProcess
KERNEL32.dll	1235	RtlUnwind
KERNEL32.dll	301	EncodePointer
KERNEL32.dll	305	EnterCriticalSection
KERNEL32.dll	957	LeaveCriticalSection
KERNEL32.dll	272	DeleteCriticalSection
KERNEL32.dll	863	InitializeCriticalSectionAndSpinCount
KERNEL32.dll	427	FreeLibrary
KERNEL32.dll	963	LoadLibraryExW
KERNEL32.dll	1122	RaiseException
KERNEL32.dll	1554	WriteFile
KERNEL32.dll	631	GetModuleHandleExW
KERNEL32.dll	470	GetCommandLineA
KERNEL32.dll	373	FindClose
KERNEL32.dll	379	FindFirstFileExW
KERNEL32.dll	396	FindNextFileW
KERNEL32.dll	907	IsValidCodePage
KERNEL32.dll	434	GetACP
KERNEL32.dll	663	GetOEMCP
KERNEL32.dll	449	GetCPInfo
KERNEL32.dll	1534	WideCharToMultiByte
KERNEL32.dll	567	GetEnvironmentStringsW
KERNEL32.dll	426	FreeEnvironmentStringsW
KERNEL32.dll	1300	SetEnvironmentVariableW
KERNEL32.dll	1354	SetStdHandle
KERNEL32.dll	590	GetFileType
KERNEL32.dll	727	GetStringTypeW
KERNEL32.dll	155	CompareStringW
KERNEL32.dll	945	LCMapStringW
KERNEL32.dll	846	HeapSize
KERNEL32.dll	415	FlushFileBuffers
KERNEL32.dll	490	GetConsoleCP
KERNEL32.dll	1315	SetFilePointerEx

show previews

offset	size	type	comment
0	444928	EXE	04/23/2023 17:05:39	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x6ba24